OpenSSF/OSV advisory MAL-2026-14438 confirms this npm version as malicious. package.json declares `preinstall: node index.js`, so `npm install` automatically runs index.js. index.js reads os.hostname(), os.userInfo(), the user home directory, DNS server configuration, and the contents of /etc/passwd and /etc/hosts, and POSTs the collected data over HTTPS to the hardcoded host 7iqn7pls4ly6w8valba0xcxygpmha7yw.oastify.com (a Burp Collaborator / OAST subdomain used as an attacker-controlled...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in remove-bg-serverless-azure (npm)
Details
package.json declares `preinstall: node index.js`, so `npm install` automatically runs index.js. index.js reads os.hostname(), os.userInfo(), the user home directory, DNS server configuration, and the contents of /etc/passwd and /etc/hosts, and POSTs the collected data over HTTPS to the hardcoded host 7iqn7pls4ly6w8valba0xcxygpmha7yw.oastify.com (a Burp Collaborator / OAST subdomain used as an attacker-controlled callback). Installing the package causes installer-side identifiers and sensitive system files to be sent to an external attacker endpoint on install.
Decision reason
OpenSSF Malicious Packages via OSV confirms remove-bg-serverless-azure@1.0.1 as malicious (MAL-2026-14438): Malicious code in remove-bg-serverless-azure (npm)