OpenSSF/OSV advisory MAL-2026-14531 confirms this npm version as malicious. On npm install, the package's preinstall hook executes index.js which harvests host and user identity data (os.hostname(), os.platform(), os.arch(), os.userInfo() including username/uid/gid/shell, homedir, cwd) and captures the output of the shell commands `whoami` and `id` via child_process. The collected data is serialized as JSON and POSTed to the hardcoded endpoint...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in analytics-v2 (npm)
Details
On npm install, the package's preinstall hook executes index.js which harvests host and user identity data (os.hostname(), os.platform(), os.arch(), os.userInfo() including username/uid/gid/shell, homedir, cwd) and captures the output of the shell commands `whoami` and `id` via child_process. The collected data is serialized as JSON and POSTed to the hardcoded endpoint https://839wbtybgrvpgbqzd0l8po2ozf56tyhn.oastify.com/system-info, a Burp Collaborator (oastify.com) out-of-band interaction subdomain unrelated to any legitimate analytics functionality. The behavior fires automatically as part of the npm install lifecycle with no user interaction.
Decision reason
OpenSSF Malicious Packages via OSV confirms analytics-v2@4.0.0 as malicious (MAL-2026-14531): Malicious code in analytics-v2 (npm)