OpenSSF/OSV advisory MAL-2026-4822 confirms this npm version as malicious. On `npm install`, the package's preinstall hook executes index.js, which collects host identifiers (hostname, username, platform, arch, cwd, pid, timestamp) and sends them as query parameters in an HTTPS request to `fxpkkxatijbbyxuhdclqig6334q9m1j8w.oast.fun`, an out-of-band callback host. package.json declares `"preinstall": "node index.js"`, so the beacon fires automatically on default install with no user...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in loadtest-browser-lib (npm)
Details
On `npm install`, the package's preinstall hook executes index.js, which collects host identifiers (hostname, username, platform, arch, cwd, pid, timestamp) and sends them as query parameters in an HTTPS request to `fxpkkxatijbbyxuhdclqig6334q9m1j8w.oast.fun`, an out-of-band callback host. package.json declares `"preinstall": "node index.js"`, so the beacon fires automatically on default install with no user interaction. The package self-describes as 'hijacking by yusif', consistent with a dependency-confusion / namespace-hijack proof-of-concept payload. Any installer running `npm install` leaks identifying machine information to the attacker's collaborator endpoint.
Decision reason
OpenSSF Malicious Packages via OSV confirms loadtest-browser-lib@1.31.3 as malicious (MAL-2026-4822): Malicious code in loadtest-browser-lib (npm)