MAL-2026-16071

Dashboard / Malicious Package / MAL-2026-16071

MAL-2026-16071

Summary: Malicious code in cat-sis2go-utils (npm)

Details: cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code (index.js is an 87-byte stub), and package.json declares both preinstall and postinstall running `node scripts/run.js`, so the payload executes twice during npm install before any application code. The script resolves a DNS canary and POSTs to a webhook.site collector; 99.1.0 additionally sends os.userInfo().username and os.hostname(). The author labels this a PoC, but the beacon fires on any install that resolves the package and exfiltrates a username usable for follow-on attacks, and dependency-confusion packages require incident response even when trivial. Source: amazon-inspector (ad357542f3dd0e1b598ef36d440b1868ac28c6889226864bf799b2f7b6bf5e91) Package [email protected] declares both preinstall and postinstall lifecycle hooks in package.json that execute scripts/run.js on every npm install. The script unconditionally issues a DNS lookup against d22d92dc-84e5-4b58-8cd6-75bf1ac452c7.dnshook.site and POSTs a JSON beacon containing the installer's hostname and process context to https://webhook.site/d22d92dc-84e5-4b58-8cd6-75bf1ac452c7. The package description self-identifies as a dependency-confusion PoC, and the 99.0.0 version is consistent with a resolution-winning squat targeting an internal package name. Installing the package results in arbitrary code execution on the installer host and fingerprints the machine to third-party out-of-band collectors under the operator's control.

References: https://www.npmjs.com/package/cat-sis2go-utils/v/99.1.0, https://www.npmjs.com/package/cat-sis2go-utils/v/99.0.0