MAL-2026-6990

    Dashboard / Malicious Package / MAL-2026-6990

    MAL-2026-6990

    Published: 8 Jul 2026Last Modified: 8 Jul 2026

    Summary: Malicious code in ai-gen-ai-opt-in (npm)

    Details: Source: amazon-inspector (a34dae027378ca986d5e99aa7c9ffc5efe590e4697e1255970ce713f6d309e74) [email protected] declares a postinstall hook (postinstall.js) that runs automatically on npm install. The script collects the installer's hostname (os.hostname()), OS username (os.userInfo().username), and public IP/geo/ISP data (fetched from ip-api.com over HTTPS), then encodes those values and issues a DNS lookup for a subdomain of an attacker-controlled Burp Collaborator-style callback host (p1r2d74iwjk057raam6myf7e258wzkt8i.oastify.com). This is a covert out-of-band DNS exfiltration channel that leaks installer identity and location data to a third party on every install, with no legitimate documented purpose.

    References: https://www.npmjs.com/package/ai-gen-ai-opt-in/v/99.0.0

    Affected packages

    Package

    Name: ai-gen-ai-opt-in

    Purl: pkg:npm/ai-gen-ai-opt-in

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0
    MAL-2026-6990 | CVE-DB