MAL-2026-17420

Dashboard / Malicious Package / MAL-2026-17420

MAL-2026-17420

Summary: Malicious code in online-header (npm)

Details: Source: amazon-inspector (4b9cc23b20e29ff5e2382e8812e86048148646c43b844f6f73db4581e790f761) [email protected] is a dependency-confusion squat (name claimed at version 99.0.0 with an inert main entry) whose `preinstall` lifecycle script runs `node callback.js`. callback.js collects host identifiers — `os.hostname()`, `os.userInfo().username`, `__dirname` install path, Node version, `os.platform()` and `os.arch()` — and POSTs them via `https.request` to the hardcoded Burp Collaborator OAST endpoint `https://bixi2qq8pkzaq6byt1e037kuul0co2cr.oastify.com`, with a DNS-based backup channel to the same subdomain. On any build system that resolves `online-header` from the public registry (for example, an internal package of the same name shadowed by this public release), `npm install` automatically transmits the installer's host identity and internal install path to a third-party collector controlled by whoever provisioned the OAST subdomain. The package's self-description as a 'dependency-confusion test' does not change the behavior: installers receive no notice and no opt-out, and the data lands at an endpoint outside their control. Source: ossf-package-analysis (161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc) The OpenSSF Package Analysis project identified 'online-header' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References: https://www.npmjs.com/package/online-header/v/99.0.0