tracker-cloudflare@1.0.0: Malicious npm security report (Block)

OSV Malicious Advisory

imported 29d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16140 confirms this npm version as malicious. The package's preinstall hook runs `node index.js`, which collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers, cwd) along with the contents of /etc/passwd and /etc/hosts, and POSTs the payload over HTTPS to the Burp Collaborator subdomain c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com. The package has empty description/author metadata and no legitimate functionality beyond this beacon...

Advisory

MAL-2026-16140

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in tracker-cloudflare (npm)

Details

The package's preinstall hook runs `node index.js`, which collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers, cwd) along with the contents of /etc/passwd and /etc/hosts, and POSTs the payload over HTTPS to the Burp Collaborator subdomain c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com. The package has empty description/author metadata and no legitimate functionality beyond this beacon. The exfiltration fires automatically on `npm install` before any consumer code runs.

Decision reason

OpenSSF Malicious Packages via OSV confirms tracker-cloudflare@1.0.0 as malicious (MAL-2026-16140): Malicious code in tracker-cloudflare (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

tracker-cloudflare@1.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code