MAL-2026-12062

    Dashboard / Malicious Package / MAL-2026-12062

    MAL-2026-12062

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boardwalk-js-tests (npm)

    Details: Source: amazon-inspector (aceb6d52ccfbb88b344c7edfe504516e6496f7886f95a8fec3b69c5127bd2924) package.json declares `preinstall: node index.js`. On `npm install`, index.js collects the installer's hostname, username, homedir, DNS server list, and current working directory, reads /etc/passwd and /etc/hosts, and POSTs the JSON payload over HTTPS to h8q14cqgn5ra8v0bjg70nqxsbjhc52tr.oastify.com — a Burp Collaborator (OAST) subdomain used as an attacker-controlled exfiltration callback. The package provides no advertised functionality; its sole install-time behavior is host reconnaissance and data exfiltration.

    References: https://www.npmjs.com/package/boardwalk-js-tests/v/1.1.1

    Affected packages

    Package

    Name: boardwalk-js-tests

    Purl: pkg:npm/boardwalk-js-tests

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.1