OpenSSF/OSV advisory MAL-2026-13481 confirms this npm version as malicious. The preinstall lifecycle script in cdf-tag-commander-helper@3.6.2 runs automatically on `npm install`. It executes `whoami` and `hostname`, retrieves the machine's public IP via ifconfig.me, and issues a plain-HTTP GET to a hardcoded Interactsh-style out-of-band callback subdomain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun), passing the three values as query parameters...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in cdf-tag-commander-helper (npm)
Details
The preinstall lifecycle script in cdf-tag-commander-helper@3.6.2 runs automatically on `npm install`. It executes `whoami` and `hostname`, retrieves the machine's public IP via ifconfig.me, and issues a plain-HTTP GET to a hardcoded Interactsh-style out-of-band callback subdomain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun), passing the three values as query parameters. The README states that the package makes no network requests, which contradicts the shipped code. The behavior is a reconnaissance beacon consistent with dependency-confusion targeting: on install, an attacker learns which internal build hosts and user accounts have resolved this package name.
Decision reason
OpenSSF Malicious Packages via OSV confirms cdf-tag-commander-helper@3.1.1 as malicious (MAL-2026-13481): Malicious code in cdf-tag-commander-helper (npm)