Threats Tagged 'mal-2026-10478'

The npm package @sectest429/hello-npm-world version 1.0.3 contains malicious code in its preinstall lifecycle script. This script executes automatically during installation and performs unauthorized reconnaissance by collecting system information including OS username, hostname, platform/architecture, running processes, and cloud instance metadata. The collected data is written to a local file named exfil.log. Although the current version does not transmit data externally, the behavior is unrelated to the package's advertised functionality and indicates a trojanized package with code execution at install time. The package should be considered fully compromised and removed.