MAL-2026-11153
Malicious code in triage_bot_using_sdkv3 (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ed39efd544cae19da3ed546fecb2383729aef637bf623e00a9cf02f1f8ded05c) package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname(), os.userInfo(), home directory, DNS server configuration, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then HTTPS-POSTs the payload to the hardcoded Burp Collaborator subdomain mh7rhchf58lgymyr9wffhwfprgx7lx9m.oastify.com. Installing the package on a default `npm install` causes installer host identifiers and local account/host files to be transmitted to an out-of-band attacker-controlled endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for triage_bot_using_sdkv3 (npm). Pin to a known-safe version or switch to an alternative.