content-publisher-sdks@1.0.1: Malicious npm security report

OSV Malicious Advisory

imported 1mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-12356 confirms this npm version as malicious. package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance (os.hostname(), os.userInfo(), homedir, DNS server list, current working directory, package.json contents) and reads /etc/passwd and /etc/hosts from the installer's filesystem, then POSTs the aggregated JSON over HTTPS to the hardcoded Burp Collaborator subdomain...

Advisory

MAL-2026-12356

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in content-publisher-sdks (npm)

Details

package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance (os.hostname(), os.userInfo(), homedir, DNS server list, current working directory, package.json contents) and reads /etc/passwd and /etc/hosts from the installer's filesystem, then POSTs the aggregated JSON over HTTPS to the hardcoded Burp Collaborator subdomain ie02j5ztgjeb6i7tp467ydwnjep8dy1n.oastify.com. The package name mimics a legitimate SDK category but its only behavior on install is this exfiltration beacon.

Decision reason

OpenSSF Malicious Packages via OSV confirms content-publisher-sdks@1.0.1 as malicious (MAL-2026-12356): Malicious code in content-publisher-sdks (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

content-publisher-sdks@1.0.1

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code