MAL-2026-12794
Malicious code in karapace-docs (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a0d1e2b10c31f45e3c73ad895a1ccd4188cdedf5ab1a795b420f5aa2693d7686) The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, then POSTs a JSON payload over HTTPS to a hardcoded Burp Collaborator subdomain n6usddpvkn7jcauar9va0xvleck48uwj.oastify.com. The package name mimics a documentation package for karapace (a Kafka registry project), consistent with a dependency-confusion / typosquat recon payload. Installer host identity and local system file contents leave the machine to an attacker-controlled OAST endpoint on `npm install` with no user interaction.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for karapace-docs (npm). Pin to a known-safe version or switch to an alternative.