MAL-2026-12483

    Dashboard / Malicious Package / MAL-2026-12483

    MAL-2026-12483

    Published: 5 Aug 2026Last Modified: 1 Sept 2026

    Summary: Malicious code in tracker-radar-detector (npm)

    Details: Source: amazon-inspector (570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1) package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, DNS server list, and current working directory, and reads /etc/passwd and /etc/hosts when present, then HTTPS POSTs the combined payload to a Burp Collaborator subdomain at mka6p95xmnkfcmdxv8cb4h2rpivej47t.oastify.com. Execution is automatic on install with no consumer interaction, and the destination is an out-of-band callback host unrelated to any legitimate tracker/detector functionality.

    References: https://www.npmjs.com/package/tracker-radar-detector/v/1.0.1

    Affected packages

    Package

    Name: tracker-radar-detector

    Purl: pkg:npm/tracker-radar-detector

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    MAL-2026-12483 | CVE-DB