OpenSSF/OSV advisory MAL-2026-14536 confirms this npm version as malicious. package.json declares a preinstall hook that runs `node index.js` on every `npm install`. index.js collects installer host identity and system files — os.hostname(), os.userInfo(), home directory, DNS server configuration, /etc/passwd, /etc/hosts, and the full package.json — and HTTPS POSTs the payload to the hardcoded Burp Collaborator subdomain e4jw9ucdu7sdebgoqqx919p6qxwoke83.oastify.com...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in mt-ts-serverless-starter (npm)
Details
package.json declares a preinstall hook that runs `node index.js` on every `npm install`. index.js collects installer host identity and system files — os.hostname(), os.userInfo(), home directory, DNS server configuration, /etc/passwd, /etc/hosts, and the full package.json — and HTTPS POSTs the payload to the hardcoded Burp Collaborator subdomain e4jw9ucdu7sdebgoqqx919p6qxwoke83.oastify.com. The exfiltration fires unconditionally at install time with no user interaction.
Decision reason
OpenSSF Malicious Packages via OSV confirms mt-ts-serverless-starter@1.0.1 as malicious (MAL-2026-14536): Malicious code in mt-ts-serverless-starter (npm)