Malicious code in @dransay/address-validation (npm)

The '@dransay/address-validation' npm package at version 99.0.0 includes a preinstall script ('node beacon.js') that triggers on 'npm install'. This script performs a DNS lookup and HTTPS GET request to a subdomain of the Interactsh collaborator service 'oast.site' under the path '/address-validation'. The high version number and preinstall callback suggest the package is used for dependency confusion probing, leaking the installer's egress IP and package name to the collaborator operator. No secrets, environment variables, or filesystem data are accessed, and no persistence or further code execution occurs. The package is identified as malicious due to its network communication with a domain linked to malicious activity.

The package leaks metadata about the installation environment, specifically the source IP address and package name, to an external malicious collaborator domain. However, it does not access or exfiltrate sensitive environment variables, installer secrets, or filesystem contents, nor does it establish persistence or execute additional malicious code. The impact is primarily information leakage of install metadata.

Avoid installing the '@dransay/address-validation' package at version 99.0.0. Since no official patch or remediation is indicated, users should remove or block this package from their dependency trees. Monitor package sources carefully to prevent dependency confusion attacks. No further action is required if this package is not used.