OpenSSF/OSV advisory MAL-2026-14060 confirms this npm version as malicious. The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via api.ipify.org, reads os.hostname(), and collects CI runner environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_RUN_ATTEMPT) from process.env, then POSTs/GETs the collected data to a hardcoded...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in fastly-vcl-language-client (npm)
Details
The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via api.ipify.org, reads os.hostname(), and collects CI runner environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_RUN_ATTEMPT) from process.env, then POSTs/GETs the collected data to a hardcoded https://webhook.site/3c201be4-c16d-4e0c-bf9c-ccc50faa8574 endpoint. It additionally performs a DNS lookup of ping-<hostname>.<oast-collaborator-domain> to exfiltrate the hostname via DNS out-of-band. The package ships no real functionality — its metadata describes it as a 'dependency test utility package' and its name resembles an internal Fastly tool, consistent with a dependency-confusion / recon probe targeting build systems that resolve internal package names against public npm.
Decision reason
OpenSSF Malicious Packages via OSV confirms fastly-vcl-language-client@1.0.0 as malicious (MAL-2026-14060): Malicious code in fastly-vcl-language-client (npm)