OpenSSF/OSV advisory MAL-2026-14138 confirms this npm version as malicious. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script collects host identifiers (os.hostname(), os.userInfo(), homedir, DNS servers, __dirname, package.json contents) and reads /etc/passwd and /etc/hosts, then POSTs the payload over HTTPS to aguu8c8gjyt4anjao3nhru1mgdm5avyk.oastify.com, a Burp Collaborator out-of-band interaction subdomain...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in optimizely-starter-kit-for-fastly-compute (npm)
Details
package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script collects host identifiers (os.hostname(), os.userInfo(), homedir, DNS servers, __dirname, package.json contents) and reads /etc/passwd and /etc/hosts, then POSTs the payload over HTTPS to aguu8c8gjyt4anjao3nhru1mgdm5avyk.oastify.com, a Burp Collaborator out-of-band interaction subdomain. The package name resembles legitimate Optimizely/Fastly Compute tooling, consistent with a dependency-confusion or typosquat exfiltration beacon.
Decision reason
OpenSSF Malicious Packages via OSV confirms optimizely-starter-kit-for-fastly-compute@1.0.1 as malicious (MAL-2026-14138): Malicious code in optimizely-starter-kit-for-fastly-compute (npm)