Malicious code in github-app-sts-action (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9434f2e4ac17da4d2b9dff0c36ed8b3c5cc3f76882b9898b768e78ba982bbac2) The package declares a preinstall lifecycle hook that runs index.js on `npm install`. index.js collects host identifiers and system files (os.hostname(), os.userInfo(), home directory, DNS servers, /etc/passwd, /etc/hosts, and package.json contents) and POSTs them via HTTPS to the hardcoded subdomain lncqub6t1loht8b887c8hvcjva13ptdi.oastify.com — a Burp Collaborator out-of-band interaction host used for reconnaissance. There is no advertised functional purpose in the package that would justify this data collection; the code path exists solely to transmit installer host and credential-adjacent file contents to an attacker-controlled endpoint. ## Source: ghsa-malware (87310aa13634f4a26c92164452e9ff0c95d3ee5924feb2f6b5c48354d32ee482) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The github-app-sts-action npm package version 1.0.1 declares a preinstall lifecycle hook that runs index.js during npm install. This script collects various host identifiers and sensitive system files such as os.hostname(), os.userInfo(), home directory contents, DNS server settings, /etc/passwd, /etc/hosts, and package.json contents. It then transmits this information via HTTPS POST to a hardcoded subdomain (lncqub6t1loht8b887c8hvcjva13ptdi.oastify.com), which is a Burp Collaborator out-of-band interaction host used for reconnaissance. The package does not advertise any legitimate functionality that would require this data collection, indicating the code is malicious and intended to exfiltrate sensitive host data during installation.
Potential Impact
Sensitive host and system information, including user and network configuration details, is exfiltrated to an attacker-controlled endpoint during package installation. This can lead to reconnaissance that facilitates further attacks or compromise of the affected system. No direct code execution beyond the preinstall script is described, but the data leakage itself poses a significant privacy and security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 1.0.1 of github-app-sts-action. Review and audit dependencies before installation, and remove any instances of this package from environments. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Malicious code in github-app-sts-action (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9434f2e4ac17da4d2b9dff0c36ed8b3c5cc3f76882b9898b768e78ba982bbac2) The package declares a preinstall lifecycle hook that runs index.js on `npm install`. index.js collects host identifiers and system files (os.hostname(), os.userInfo(), home directory, DNS servers, /etc/passwd, /etc/hosts, and package.json contents) and POSTs them via HTTPS to the hardcoded subdomain lncqub6t1loht8b887c8hvcjva13ptdi.oastify.com — a Burp Collaborator out-of-band interaction host used for reconnaissance. There is no advertised functional purpose in the package that would justify this data collection; the code path exists solely to transmit installer host and credential-adjacent file contents to an attacker-controlled endpoint. ## Source: ghsa-malware (87310aa13634f4a26c92164452e9ff0c95d3ee5924feb2f6b5c48354d32ee482) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The github-app-sts-action npm package version 1.0.1 declares a preinstall lifecycle hook that runs index.js during npm install. This script collects various host identifiers and sensitive system files such as os.hostname(), os.userInfo(), home directory contents, DNS server settings, /etc/passwd, /etc/hosts, and package.json contents. It then transmits this information via HTTPS POST to a hardcoded subdomain (lncqub6t1loht8b887c8hvcjva13ptdi.oastify.com), which is a Burp Collaborator out-of-band interaction host used for reconnaissance. The package does not advertise any legitimate functionality that would require this data collection, indicating the code is malicious and intended to exfiltrate sensitive host data during installation.
Potential Impact
Sensitive host and system information, including user and network configuration details, is exfiltrated to an attacker-controlled endpoint during package installation. This can lead to reconnaissance that facilitates further attacks or compromise of the affected system. No direct code execution beyond the preinstall script is described, but the data leakage itself poses a significant privacy and security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 1.0.1 of github-app-sts-action. Review and audit dependencies before installation, and remove any instances of this package from environments. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12389
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735745bf8831d539159f53
Added to database: 08/05/2026, 15:31:17 UTC
Last enriched: 08/05/2026, 17:26:09 UTC
Last updated: 09/08/2026, 04:37:17 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.