OpenSSF/OSV advisory MAL-2026-12334 confirms this npm version as malicious. scripts/preinstall.js runs automatically on npm install and collects host identity from the installer machine — os.hostname(), OS type/version/release, architecture, the output of `whoami`, non-internal IPv4 addresses on all network interfaces, Node version, and package identity — then POSTs the JSON body to a hardcoded author-controlled endpoint at https://callback.kuldeep.io/beacon, with a plaintext HTTP fallback...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in ach-detail (npm)
Details
scripts/preinstall.js runs automatically on npm install and collects host identity from the installer machine — os.hostname(), OS type/version/release, architecture, the output of `whoami`, non-internal IPv4 addresses on all network interfaces, Node version, and package identity — then POSTs the JSON body to a hardcoded author-controlled endpoint at https://callback.kuldeep.io/beacon, with a plaintext HTTP fallback to http://callback.kuldeep.io/beacon when HTTPS fails. The endpoint is not caller-configurable and the installer never opts in; self-labeling in the file as an authorized PoC or bug-bounty placeholder is author-controlled text and does not constitute installer consent. The plaintext fallback additionally exposes the collected identifiers on the wire.
Decision reason
OpenSSF Malicious Packages via OSV confirms ach-detail@99.0.2 as malicious (MAL-2026-12334): Malicious code in ach-detail (npm)