OpenSSF/OSV advisory MAL-2026-13436 confirms this npm version as malicious. The package declares a preinstall lifecycle script (preinstall.js) that automatically runs on npm install. The script reads the installer's OS username (from process.env USER/USERNAME) and hostname (os.hostname()), embeds them into a subdomain of a hardcoded 4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com callback host, and transmits them via both a DNS lookup and an HTTPS GET to that host at path /depconf/...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @wbnr/frontend-shared (npm)
Details
The package declares a preinstall lifecycle script (preinstall.js) that automatically runs on npm install. The script reads the installer's OS username (from process.env USER/USERNAME) and hostname (os.hostname()), embeds them into a subdomain of a hardcoded 4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com callback host, and transmits them via both a DNS lookup and an HTTPS GET to that host at path /depconf/. The behavior is consistent with a dependency-confusion probe using Burp Collaborator (oastify.com) infrastructure; installer identifiers (username, internal hostname, timestamp, package name) are disclosed to a third-party callback domain on every install.
Decision reason
OpenSSF Malicious Packages via OSV confirms @wbnr/frontend-shared@99.0.1 as malicious (MAL-2026-13436): Malicious code in @wbnr/frontend-shared (npm)