MAL-2026-14377

Dashboard / Malicious Package / MAL-2026-14377

MAL-2026-14377

Summary: Malicious code in stillm4ddpocs-rtest-alpha (npm)

Details: Source: amazon-inspector (47545f800dcb07213863afb8beab283755fb596ea7d5d478b60e4ff449453839) package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's local IPv4, public IP (via https://api.ipify.org, https://icanhazip.com, https://ifconfig.me), DNS-resolver IP, hostname, OS username, home directory, cwd, and the parent project's package.json name/author/repository/homepage, then transmits the JSON to the hardcoded callback da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun via three channels: HTTP POST on:80, HTTPS POST on:443, and DNS TXT queries whose labels carry the hex-encoded payload split into 60-character chunks. The DNS covert channel and hex chunking are structured to bypass egress filtering that blocks outbound HTTP. The package's self-description as 'authorised security research' does not gate execution; any project that resolves this name at install time transmits the data without consent. The 999.9.9 version and lure name are consistent with a dependency-confusion probe.

References: https://www.npmjs.com/package/stillm4ddpocs-rtest-alpha/v/999.9.10, https://www.npmjs.com/package/stillm4ddpocs-rtest-alpha/v/999.9.9