MAL-2026-14411

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594) npm package dpg-media-7ehemel@999.9.15 executes `node index.js` from a `preinstall` lifecycle script that harvests installer identity and environment context and beacons it to the hardcoded host `da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun`. The script collects `os.hostname()`, username/home/cwd/INIT_CWD, local and public IP addresses (via https.get to api.ipify.org / icanhazip.com / ifconfig.me), resolver IPs, and CI metadata (repo, actor, run id, workflow, AWS region), and spawns `gh api user --jq.login`, `npm whoami`, and `git config user.email` to attribute the environment to a specific developer/org, plus reads parent project package.json fields. The payload is serialized as JSON, hex-encoded, chunked to 60-character DNS labels, and exfiltrated both via `dns.resolve` subdomain queries (`${i}-${c}.u-${uuid}.<callback>`) and via HTTP/HTTPS POST to `/poc/${uuid}` on the same callback host. The version string 999.9.15 and the developer-identity harvest are characteristic of a dependency-confusion beacon targeting a private-scope name. Any self-description as authorized research is contradicted by the DNS-tunneling exfiltration channel and the absence of installer consent.

## Source: ossf-package-analysis (77fbceeb8527e33ef6a3b68c9238f3a25b9ccaf8e2023b1e12b2a95e3a0f274e) The OpenSSF Package Analysis project identified 'dpg-media-7ehemel' @ 999.9.15 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.