MAL-2026-12033

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6f0750fab7cca2996255b57d6fa98107b2d6b710fc8ab62f30345158ff3b7560) The package's package.json declares a `preinstall: node index.js` hook that fires automatically on `npm install`. index.js collects host reconnaissance data (os.hostname(), os.userInfo().username, home directory, DNS server configuration) and reads local system files including /etc/passwd and /etc/hosts, then HTTPS-POSTs the collected data to the hardcoded Burp Collaborator subdomain b5hv16nakzo45px5ga4ukkum8de52vqk.oastify.com. oastify.com is Burp Suite's out-of-band interaction service, commonly used as an attacker-controlled exfiltration sink. There is no legitimate functionality; the package's sole install-time behavior is host recon and data exfiltration.