MAL-2026-12483
Malicious code in tracker-radar-detector (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1) package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, DNS server list, and current working directory, and reads /etc/passwd and /etc/hosts when present, then HTTPS POSTs the combined payload to a Burp Collaborator subdomain at mka6p95xmnkfcmdxv8cb4h2rpivej47t.oastify.com. Execution is automatic on install with no consumer interaction, and the destination is an out-of-band callback host unrelated to any legitimate tracker/detector functionality.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tracker-radar-detector (npm). Pin to a known-safe version or switch to an alternative.