MAL-2026-4634
Dashboard / Malicious Package / MAL-2026-4634
MAL-2026-4634
Summary: Malicious code in osep-react-antd (npm)
Details: Source: amazon-inspector (9373e8880ad89854cc168b48a36c59bd72abfaf220e08fb751b948f0c4d8ddfb) package.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js collects host identifiers (os.hostname(), process.platform, arch, os.homedir(), os.userInfo() including uid/gid/username/shell, cwd) and the output of `whoami` and `id` via child_process, then POSTs the JSON payload to a hardcoded URL `https://qtn11857tbs7r8jtj0bj2250xr3jrafz.oastify.com/detox56`. The oastify.com host is Burp Suite Collaborator out-of-band infrastructure used to receive callbacks from compromised installers. The package name mimics React/Ant Design naming conventions and ships empty author/description/license metadata with no functional code beyond the beacon — the dependency-confusion squat shape. Installer harm: every `npm install` of this package leaks the installer's hostname, username, uid/gid, and shell to the attacker, identifying internal corporate environments and CI runners for follow-on targeting.
Affected packages
Package
Name: osep-react-antd
Purl: pkg:npm/osep-react-antd
Affected ranges
Type: N/A
Events:
