zluri-ad-connector
This report shows the evidence for zluri-ad-connector@9.9.9, the only known version.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-6910 confirms this npm version as malicious.
Advisory
MAL-2026-6910
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in zluri-ad-connector (npm)
Details
The package declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js requires `os`, `dns`, `https`, `querystring`, and the local `package.json`, then harvests values from `process.env` matching a large sensitive-token allowlist (npm, GitHub, AWS, CI tokens, and generic `secret`/`token`/`password`/`api_key` names) along with `os.hostname()`, `os.userInfo()`, `os.platform()`, homedir, PATH, DNS server list, and package metadata. The collected bundle is POSTed over HTTPS to `y543452sgo96xsasfdr72ms4rvxmld92.oastify.com`, a Burp Collaborator subdomain used as an attacker-controlled exfiltration sink. The package name `zluri-ad-connector` combined with the canonical dependency-confusion version `9.9.9` indicates an intentional attempt to shadow a private Zluri internal package name so that CI resolvers pull this public malicious package.
## Source: ossf-package-analysis (04e770be48b9eacfda9794e0b5865d9fb1a0232dfa90b97bfc05c75cb92dc8fe) The OpenSSF Package Analysis project identified 'zluri-ad-connector' @ 9.9.9 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to zluri-ad-connector@9.9.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing zluri-ad-connector@9.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.