OpenSSF/OSV advisory MAL-2026-14392 confirms this npm version as malicious. The package declares scripts.preinstall = 'node vishu.js', which runs automatically on npm install. vishu.js resolves the installer's public IP via api.ipify.org, reads CI-related environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID and related), and issues an HTTPS GET to a hardcoded webhook.site collector URL carrying those fields...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in message-compiler (npm)
Details
The package declares scripts.preinstall = 'node vishu.js', which runs automatically on npm install. vishu.js resolves the installer's public IP via api.ipify.org, reads CI-related environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID and related), and issues an HTTPS GET to a hardcoded webhook.site collector URL carrying those fields. It additionally performs a DNS lookup of a subdomain constructed from os.hostname() under a hardcoded oastify.com (Burp Collaborator) domain, exfiltrating the installer's hostname via DNS. The package name typosquats the scoped @intlify/message-compiler package and its only functional code is this beacon.
Decision reason
OpenSSF Malicious Packages via OSV confirms message-compiler@9.2.0 as malicious (MAL-2026-14392): Malicious code in message-compiler (npm)