Threats Tagged 'mal-2026-16357'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27) The package declares a preinstall lifecycle script that executes index.js on `npm install`. index.js uses child_process.exec to run a curl command whose URL embeds `$(hostname)` and `$(whoami)` as subdomains of `sgc6vj7rjciuailqx2kfebc7pyvpjk79.oastify.com`, a Burp Collaborator (OAST) host. On install, the installer's hostname and username are transmitted to that attacker-controlled destination via DNS resolution and HTTP. The package name is a random alphanumeric scope with no legitimate functionality; the sole observable behavior is host reconnaissance exfiltration at install time. This is the canonical dependency-confusion / OAST recon payload shape. ## Source: ossf-package-analysis (278821d7a9d245a4193d8536c0b127f61cf1b13335dfe91abaefece6b908a57e) The OpenSSF Package Analysis project identified '@asdfaskdjfksadhfkasf/nadaver2' @ 102.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.