MAL-2026-10733

    Dashboard / Malicious Package / MAL-2026-10733

    MAL-2026-10733

    Published: 16 Jul 2026Last Modified: 16 Jul 2026

    Summary: Malicious code in idlive-document-capture-web (npm)

    Details: Source: amazon-inspector (d428a1956dd86e85bfb6fb83cba2dea11bfc19250c1262d13a88c3bdd8ca07e0) Package name typosquats the legitimate 'idlive' family and ships no library functionality. package.json declares a preinstall lifecycle hook ("preinstall": "node index.js") that auto-executes on npm install. index.js collects host reconnaissance — hostname, platform, arch, username, uid/gid, shell, homedir, cwd, and the output of `whoami`/`id` spawned via child_process — and POSTs the collected data as JSON to the hardcoded attacker-controlled endpoint https://koc9471aou79yxauab6in903uu0locc1.oastify.com/detox56. The oastify.com host is Burp Suite Collaborator, an out-of-band interaction service commonly used as an exfiltration sink. There is no legitimate purpose for this behavior; the package exists solely to beacon installer-side identifiers to the attacker's OAST subdomain at install time.

    References: https://www.npmjs.com/package/idlive-document-capture-web/v/14.2.1

    Affected packages

    Package

    Name: idlive-document-capture-web

    Purl: pkg:npm/idlive-document-capture-web

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    14.2.1
    MAL-2026-10733 | CVE-DB