MAL-2026-4822

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (934a61b207f82f8549de09139a73a80f47746bba1dacd21f657d34e6e542324e) On `npm install`, the package's preinstall hook executes index.js, which collects host identifiers (hostname, username, platform, arch, cwd, pid, timestamp) and sends them as query parameters in an HTTPS request to `fxpkkxatijbbyxuhdclqig6334q9m1j8w.oast.fun`, an out-of-band callback host. package.json declares `"preinstall": "node index.js"`, so the beacon fires automatically on default install with no user interaction. The package self-describes as 'hijacking by yusif', consistent with a dependency-confusion / namespace-hijack proof-of-concept payload. Any installer running `npm install` leaks identifying machine information to the attacker's collaborator endpoint.