OpenSSF/OSV advisory MAL-2026-4635 confirms this npm version as malicious. On `npm install`, preinstall.js collects hostname, username, platform, cwd, timestamp, and a full dump of os.networkInterfaces() and HTTP-GETs them as query parameters to a hardcoded Burp Collaborator (oastify.com) endpoint. Errors are silently swallowed (the source comment notes 'Silent fail to avoid detection')...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in payment-account-input-selector (npm)
Details
On `npm install`, preinstall.js collects hostname, username, platform, cwd, timestamp, and a full dump of os.networkInterfaces() and HTTP-GETs them as query parameters to a hardcoded Burp Collaborator (oastify.com) endpoint. Errors are silently swallowed (the source comment notes 'Silent fail to avoid detection'). The package's metadata advertises an Oracle JET payment account selector but ships only a 5-line stub for index.js — the only real logic is the install-time beacon. The combination of empty author metadata, generic 'oracle/jet/payment' keywords, hollow main entry, and a recon-only preinstall is consistent with a dependency-confusion probe against an internal Oracle JET package name, with installer host/network topology exfiltrated to the attacker's OAST collector.
Decision reason
OpenSSF Malicious Packages via OSV confirms payment-account-input-selector@1.0.0 as malicious (MAL-2026-4635): Malicious code in payment-account-input-selector (npm)