OpenSSF/OSV advisory MAL-2026-14262 confirms this npm version as malicious. The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hostname, full process.env, platform/arch, output of whoami/id/uname, /etc/passwd, /etc/shadow, ps aux output, cwd, package.json, node_modules listing, ~/.npmrc, and the most recent ~/.npm/_logs files — and POSTs each item over plain HTTP to the hardcoded attacker-controlled host...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in pump-fun-skills (npm)
Details
The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hostname, full process.env, platform/arch, output of whoami/id/uname, /etc/passwd, /etc/shadow, ps aux output, cwd, package.json, node_modules listing, ~/.npmrc, and the most recent ~/.npm/_logs files — and POSTs each item over plain HTTP to the hardcoded attacker-controlled host 6lsgfv2czhs95it3wc9fpjyovf19pzdo.oastify.com (a Burp Collaborator subdomain). Reading ~/.npmrc harvests the installer's npm registry auth token, enabling downstream hijack of packages published under the installer's identity. The package name and reconnaissance commands additionally search the filesystem for directories matching *pump.fun* and *padre.gg*, and package.json falsely describes the package as an esbuild netbsd-x64 build — a typosquat/impersonation lure targeting developers in those crypto-frontend ecosystems.
Decision reason
OpenSSF Malicious Packages via OSV confirms pump-fun-skills@20.1.1 as malicious (MAL-2026-14262): Malicious code in pump-fun-skills (npm)