Threats Tagged 'mal-2026-10763'

The @edgecommons/streamlog-node package on npm was published as part of a dependency confusion reconnaissance campaign. It uses a preinstall hook to execute code at install time that collects host telemetry including public IP, hostname, OS username, and environment metadata, then sends this data to an attacker-controlled Sentry endpoint. The package mimics an internal namespace to trick misconfigured resolvers into installing it instead of a legitimate private dependency. This behavior is consistent with reconnaissance rather than direct exploitation or payload delivery.