MAL-2026-12796

    Dashboard / Malicious Package / MAL-2026-12796

    MAL-2026-12796

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in messenger-style (npm)

    Details: Source: amazon-inspector (48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10) The package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().username`, home directory, DNS servers) and reads `/etc/passwd` and `/etc/hosts` from the installer's machine, then POSTs the collected data over HTTPS to the hardcoded host `pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com` (a Burp Collaborator out-of-band interaction domain). The package name suggests a messaging utility, but no such functionality is present — the sole behavior on `npm install` is host reconnaissance and exfiltration to an attacker-controlled OAST endpoint.

    References: https://www.npmjs.com/package/messenger-style/v/1.0.1

    Affected packages

    Package

    Name: messenger-style

    Purl: pkg:npm/messenger-style

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1