MAL-2026-12040

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3784f08ba715b7afbeecfaa10b9c953b4406770c976bd07200977fa2f80b0317) On `npm install`, the package's preinstall script (index.js) collects installer-side system data — os.hostname(), os.userInfo().username, home directory, DNS server list, and package metadata — reads /etc/passwd and /etc/hosts from the installer's filesystem, and POSTs the aggregated JSON payload over HTTPS to the Burp Collaborator subdomain 67bqctsh977zz60hiszvr1pbc2iu6ku9.oastify.com. The behavior fires automatically as a lifecycle hook, without any user action beyond installation. The oastify.com destination is an out-of-band recon endpoint unrelated to any documented purpose of the package, and the payload structure (host identity + /etc/passwd + /etc/hosts) is a canonical dependency-confusion / reconnaissance beacon.