OpenSSF/OSV advisory MAL-2026-4535 confirms this npm version as malicious. package.json declares `"preinstall": "node index.js"`, which fires automatically on `npm install`. index.js collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers) and reads sensitive system files (/etc/passwd, /etc/hosts) plus package metadata, then HTTPS POSTs the bundle to a hardcoded Burp Collaborator subdomain `hzklpyrf8gdhgtycz16veroqihobc10q.oastify.com`...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in configcat-trello-powerup (npm)
Details
package.json declares `"preinstall": "node index.js"`, which fires automatically on `npm install`. index.js collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers) and reads sensitive system files (/etc/passwd, /etc/hosts) plus package metadata, then HTTPS POSTs the bundle to a hardcoded Burp Collaborator subdomain `hzklpyrf8gdhgtycz16veroqihobc10q.oastify.com`. The package ships no real functionality — empty description, empty author, and a name resembling a plausible internal Trello/ConfigCat integration — fingerprint of a dependency-confusion squat whose only purpose is to beacon installer-side data to the attacker for follow-on targeting.
Decision reason
OpenSSF Malicious Packages via OSV confirms configcat-trello-powerup@1.0.0 as malicious (MAL-2026-4535): Malicious code in configcat-trello-powerup (npm)