MAL-2026-14370

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a) Package published to public npm under an internal-looking scope (@usaa-grp-personal-profile) at version 999.0.0, a shape consistent with dependency-confusion targeting an organization's internal registry. package.json declares preinstall and postinstall hooks that execute beacon.js on npm install. beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), hex-encodes them into DNS labels, and issues dns.lookup queries against a subdomain of oastify.com (Burp Collaborator out-of-band service), transmitting installer host, user, and working-directory identifiers to a third-party OAST endpoint on every install. The exfiltration fires automatically without user invocation and reaches an attacker-controllable Collaborator subdomain regardless of any research/PoC framing in the package metadata.