MAL-2026-12497

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (dcf384e12e957c8d6b3d0014504f652cd2b6f3885f49820a2907865566bb6137) package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS server configuration, package metadata, and the contents of /etc/passwd and /etc/hosts, then POSTs the collected data over HTTPS to the hardcoded host slh4v8u1tz6gjo447tgf9rl3xu3mrcf1.oastify.com (a Burp Collaborator OAST subdomain). The package has no legitimate functionality that would justify reading local system files or beaconing host identifiers to an out-of-band interaction service; the shape matches a dependency-confusion / typosquat exfiltration beacon.