MAL-2026-12483

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1) package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, DNS server list, and current working directory, and reads /etc/passwd and /etc/hosts when present, then HTTPS POSTs the combined payload to a Burp Collaborator subdomain at mka6p95xmnkfcmdxv8cb4h2rpivej47t.oastify.com. Execution is automatic on install with no consumer interaction, and the destination is an out-of-band callback host unrelated to any legitimate tracker/detector functionality.