Malicious code in dransay (npm)

The 'dransay' npm package at version 99.0.0 declares a 'preinstall' lifecycle script that runs 'node beacon.js'. This script performs a DNS lookup and HTTPS GET request to a hardcoded Interactsh collaborator subdomain (db3klhbi6i9hark1kegg174t38h33b6wt.oast.site) on every 'npm install'. The outbound request discloses sensitive network identity information including the installer's source IP, DNS resolver IP, hostname-derived data, and timestamp to a third-party collaborator host unrelated to any legitimate publisher. The package name and unusually high version number suggest it is a dependency-confusion probe targeting internal package names. The README self-labels the package as a benign proof-of-concept, but the behavior involves non-consensual data exfiltration during installation.

Installation of this package results in leakage of network identity information to an external third-party server. This can expose the installer's IP address, DNS resolver IP, hostname information, and installation timestamp, potentially compromising privacy and internal network details. There is no indication of further exploitation or code execution beyond this data exfiltration.

No official patch or remediation is indicated. Users should avoid installing the 'dransay' package version 99.0.0. Since this is a malicious package designed as a proof-of-concept for dependency confusion, verifying package sources and avoiding untrusted or suspicious packages is recommended. No vendor advisory or fix is available; patch status is not yet confirmed — check vendor advisories for updates.