OpenSSF/OSV advisory MAL-2026-13754 confirms this npm version as malicious. package.json declares `postinstall: node index.js`, causing index.js to run automatically on `npm install`. The script collects the installer's username (via `whoami`), `os.hostname()`, `process.cwd()`, and non-internal IPv4 addresses from `os.networkInterfaces()`, then sends them as query-string parameters via HTTPS GET to the hardcoded endpoint `https://xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com`. The...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in dependencyfsdsfdsfg (npm)
Details
package.json declares `postinstall: node index.js`, causing index.js to run automatically on `npm install`. The script collects the installer's username (via `whoami`), `os.hostname()`, `process.cwd()`, and non-internal IPv4 addresses from `os.networkInterfaces()`, then sends them as query-string parameters via HTTPS GET to the hardcoded endpoint `https://xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com`. The `*.oastify.com` host is a Burp Collaborator out-of-band interaction domain. Package metadata is consistent with a dependency-confusion probe: gibberish name `dependencyfsdsfdsfg`, version `99.9.0`, empty author/description/keywords.
Decision reason
OpenSSF Malicious Packages via OSV confirms dependencyfsdsfdsfg@99.9.0 as malicious (MAL-2026-13754): Malicious code in dependencyfsdsfdsfg (npm)