MAL-2026-16140

    Dashboard / Malicious Package / MAL-2026-16140

    MAL-2026-16140

    Published: 11 Sept 2026Last Modified: 11 Sept 2026

    Summary: Malicious code in tracker-cloudflare (npm)

    Details: Source: amazon-inspector (55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4) The package's preinstall hook runs `node index.js`, which collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers, cwd) along with the contents of /etc/passwd and /etc/hosts, and POSTs the payload over HTTPS to the Burp Collaborator subdomain c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com. The package has empty description/author metadata and no legitimate functionality beyond this beacon. The exfiltration fires automatically on `npm install` before any consumer code runs.

    References: https://www.npmjs.com/package/tracker-cloudflare/v/1.0.0

    Affected packages

    Package

    Name: tracker-cloudflare

    Purl: pkg:npm/tracker-cloudflare

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0