OpenSSF/OSV advisory MAL-2026-12796 confirms this npm version as malicious. The package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().username`, home directory, DNS servers) and reads `/etc/passwd` and `/etc/hosts` from the installer's machine, then POSTs the collected data over HTTPS to the hardcoded host `pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com` (a Burp Collaborator out-of-band interaction domain)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in messenger-style (npm)
Details
The package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().username`, home directory, DNS servers) and reads `/etc/passwd` and `/etc/hosts` from the installer's machine, then POSTs the collected data over HTTPS to the hardcoded host `pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com` (a Burp Collaborator out-of-band interaction domain). The package name suggests a messaging utility, but no such functionality is present — the sole behavior on `npm install` is host reconnaissance and exfiltration to an attacker-controlled OAST endpoint.
Decision reason
OpenSSF Malicious Packages via OSV confirms messenger-style@1.0.1 as malicious (MAL-2026-12796): Malicious code in messenger-style (npm)