checkmate-remediation-assistant@1.0.0

OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17572 confirms this npm version as malicious. The package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname(), os.userInfo(), the home directory, DNS server configuration, __dirname, the local package.json, and the contents of /etc/passwd and /etc/hosts, then transmits the collected data over HTTPS to a hardcoded Burp Collaborator (oastify.com) subdomain (9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com)...

Advisory

MAL-2026-17572

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in checkmate-remediation-assistant (npm)

Details

The package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname(), os.userInfo(), the home directory, DNS server configuration, __dirname, the local package.json, and the contents of /etc/passwd and /etc/hosts, then transmits the collected data over HTTPS to a hardcoded Burp Collaborator (oastify.com) subdomain (9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com). The destination is an out-of-band interaction server not associated with any declared publisher or documented package purpose, and the exfiltration fires automatically on default install without user interaction.

Decision reason

OpenSSF Malicious Packages via OSV confirms checkmate-remediation-assistant@1.0.0 as malicious (MAL-2026-17572): Malicious code in checkmate-remediation-assistant (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

checkmate-remediation-assistant@1.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code