MAL-2026-12796
Malicious code in messenger-style (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10) The package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().username`, home directory, DNS servers) and reads `/etc/passwd` and `/etc/hosts` from the installer's machine, then POSTs the collected data over HTTPS to the hardcoded host `pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com` (a Burp Collaborator out-of-band interaction domain). The package name suggests a messaging utility, but no such functionality is present — the sole behavior on `npm install` is host reconnaissance and exfiltration to an attacker-controlled OAST endpoint.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for messenger-style (npm). Pin to a known-safe version or switch to an alternative.