OpenSSF/OSV advisory MAL-2026-14161 confirms this npm version as malicious. The package's package.json declares a preinstall script that runs index.js automatically on `npm install`. index.js shells out via child_process.exec to collect the installer's hostname, current working directory, username, a package marker, and the machine's public IP (fetched via curl to ifconfig.me)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm)
Details
The package's package.json declares a preinstall script that runs index.js automatically on `npm install`. index.js shells out via child_process.exec to collect the installer's hostname, current working directory, username, a package marker, and the machine's public IP (fetched via curl to ifconfig.me). The aggregated output is hex-encoded with xxd and split into DNS labels queried via nslookup against subdomains of snurkeburk.com, a DNS-tunnel exfiltration channel that bypasses egress HTTP filtering. Installing this package causes host identifiers and public IP to leave the machine to an attacker-controlled DNS namespace.
Decision reason
OpenSSF Malicious Packages via OSV confirms @sidp-kiosk/test-npm-snurkeburk-hackerone@2.999.0 as malicious (MAL-2026-14161): Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm)