MAL-2025-49410

Dashboard / Malicious Package / MAL-2025-49410

MAL-2025-49410

Summary: Malicious code in frontend-vue-next (npm)

Details: Source: amazon-inspector (5ecba1e4c2f32734e178b8a3697ed962053354867af75787af708f92f0da2474) package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script collects system identity (os.hostname(), os.userInfo() including username/uid/gid/shell, platform, arch, home directory, cwd, cpu/memory info) and executes shell commands `whoami` and `id` via child_process, then POSTs the aggregated JSON to a hardcoded URL https://7z7l0xz2ay3chokh48nrncmaz15stih7.oastify.com/testbydext. The destination is a Burp Suite Collaborator out-of-band subdomain — a throwaway, attacker-controlled listener used to capture exfiltrated data. The package metadata is empty (no author, no description, no repository), and the name rides on the Vue/Next.js namespace as a lure. Installing this package on a developer machine or CI runner leaks host and user identity to the attacker without consent.

References: https://www.npmjs.com/package/frontend-vue-next/v/1.2.0, https://github.com/advisories/GHSA-7492-2cqc-6827