OpenSSF/OSV advisory MAL-2026-13882 confirms this npm version as malicious. package.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js shells out via child_process and curl to POST the installer's `whoami`, `hostname`, and `id` output along with base64-encoded contents of `/etc/passwd`, `/etc/hosts`, and (if readable) `/etc/shadow` to a hardcoded out-of-band interactsh/OAST endpoint at `5f8a1ed70fb7761d678agw9bucryyyyyb.oast.site`...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in verify-cli (npm)
Details
package.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js shells out via child_process and curl to POST the installer's `whoami`, `hostname`, and `id` output along with base64-encoded contents of `/etc/passwd`, `/etc/hosts`, and (if readable) `/etc/shadow` to a hardcoded out-of-band interactsh/OAST endpoint at `5f8a1ed70fb7761d678agw9bucryyyyyb.oast.site`. Package metadata shows an implausible version (99.0.0), placeholder description ("Nodejs SDK for Redacted"), and a nonexistent dependency, consistent with a dependency-confusion / typosquat beacon rather than a legitimate SDK.
Decision reason
OpenSSF Malicious Packages via OSV confirms verify-cli@99.0.0 as malicious (MAL-2026-13882): Malicious code in verify-cli (npm)