MAL-2026-14531

    Dashboard / Malicious Package / MAL-2026-14531

    MAL-2026-14531

    Published: 26 Aug 2026Last Modified: 26 Aug 2026

    Summary: Malicious code in analytics-v2 (npm)

    Details: Source: amazon-inspector (a589041eddd586d6269526f6c6e67f6b645994a24a143af07e35d8e2f9ce0982) On npm install, the package's preinstall hook executes index.js which harvests host and user identity data (os.hostname(), os.platform(), os.arch(), os.userInfo() including username/uid/gid/shell, homedir, cwd) and captures the output of the shell commands `whoami` and `id` via child_process. The collected data is serialized as JSON and POSTed to the hardcoded endpoint https://839wbtybgrvpgbqzd0l8po2ozf56tyhn.oastify.com/system-info, a Burp Collaborator (oastify.com) out-of-band interaction subdomain unrelated to any legitimate analytics functionality. The behavior fires automatically as part of the npm install lifecycle with no user interaction.

    References: https://www.npmjs.com/package/analytics-v2/v/4.0.0

    Affected packages

    Package

    Name: analytics-v2

    Purl: pkg:npm/analytics-v2

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.0.0
    MAL-2026-14531 | CVE-DB