MAL-2025-889

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a0ac597bf732e187011fdef75554843eec3e581b18fdf2c0e83b4dd4aa559731) package.json declares `preinstall: node index.js`, so on `npm install` the shipped index.js runs automatically. It collects hostname, username, home directory, DNS servers, and current working directory, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then POSTs the bundle over HTTPS to the hardcoded host `agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com` (a Burp Collaborator out-of-band subdomain). The package name and single-purpose recon payload match the dependency-confusion reconnaissance pattern: no library functionality is shipped, only install-time data exfiltration to an attacker-controlled OOB host.