MAL-2026-12796
Malicious code in messenger-style (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10) The package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().username`, home directory, DNS servers) and reads `/etc/passwd` and `/etc/hosts` from the installer's machine, then POSTs the collected data over HTTPS to the hardcoded host `pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com` (a Burp Collaborator out-of-band interaction domain). The package name suggests a messaging utility, but no such functionality is present — the sole behavior on `npm install` is host reconnaissance and exfiltration to an attacker-controlled OAST endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for messenger-style (npm). Pin to a known-safe version or switch to an alternative.