MAL-2026-17572

Dashboard / Malicious Package / MAL-2026-17572

MAL-2026-17572

Summary: Malicious code in checkmate-remediation-assistant (npm)

Details: [email protected] contains no functional code: its only behaviour is a preinstall script that runs `node index.js` on npm install. index.js collects the install directory, the user's home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends them as JSON in an HTTPS POST to `9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com`, a Burp Collaborator endpoint. The npm account testneo7755 published it on 2026-10-05 and it was unpublished about two minutes later; the same account published with-cte the same day with the same index.js and a different Collaborator subdomain. Source: amazon-inspector (c8f55d0ebeea19e228ec6edbb1782df87539c476478d3935559fda90a458b1b4) The package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname(), os.userInfo(), the home directory, DNS server configuration, __dirname, the local package.json, and the contents of /etc/passwd and /etc/hosts, then transmits the collected data over HTTPS to a hardcoded Burp Collaborator (oastify.com) subdomain (9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com). The destination is an out-of-band interaction server not associated with any declared publisher or documented package purpose, and the exfiltration fires automatically on default install without user interaction.

References: https://www.npmjs.com/package/checkmate-remediation-assistant/v/1.0.0, https://www.npmjs.com/package/checkmate-remediation-assistant