MAL-2026-12809

    Dashboard / Malicious Package / MAL-2026-12809

    MAL-2026-12809

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in technical-challenge (npm)

    Details: Source: amazon-inspector (6921f72a1b4fbaaba87fcbe3cb30137815e7e2bb932ffa794acd0010b8954c5f) package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script collects installer-side data — hostname, username, home directory, DNS server list, current working directory, package.json contents, and the contents of /etc/passwd and /etc/hosts — and HTTPS-POSTs it to a hardcoded Burp Collaborator subdomain at 5z5h9l8e7cktx1ihl6usn4zgb7h15rtg.oastify.com. The exfiltration fires unconditionally on install with no user interaction.

    References: https://www.npmjs.com/package/technical-challenge/v/1.0.1

    Affected packages

    Package

    Name: technical-challenge

    Purl: pkg:npm/technical-challenge

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1