OpenSSF/OSV advisory MAL-2026-12386 confirms this npm version as malicious. fundraiserservpp@2.0.0 runs `node index.js` as a `preinstall` lifecycle script on `npm install`. The script collects host metadata from the installer machine — `os.hostname()`, `os.platform()`, `os.arch()`, the user home directory path, and configured DNS servers — and issues an HTTPS POST to a hardcoded Burp Collaborator subdomain (`mrh99ucv1u3kyeba1020ae2t7kdc12pr.oastify.com/hit`) with that data as a JSON body...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in fundraiserservpp (npm)
Details
fundraiserservpp@2.0.0 runs `node index.js` as a `preinstall` lifecycle script on `npm install`. The script collects host metadata from the installer machine — `os.hostname()`, `os.platform()`, `os.arch()`, the user home directory path, and configured DNS servers — and issues an HTTPS POST to a hardcoded Burp Collaborator subdomain (`mrh99ucv1u3kyeba1020ae2t7kdc12pr.oastify.com/hit`) with that data as a JSON body. The beacon fires automatically at install time with no user interaction. The destination is an attacker-controlled out-of-band interaction endpoint typical of dependency-confusion reconnaissance, confirming to the operator that the package name was successfully resolved and installed inside a target build environment.
Decision reason
OpenSSF Malicious Packages via OSV confirms fundraiserservpp@2.0.0 as malicious (MAL-2026-12386): Malicious code in fundraiserservpp (npm)