MAL-2026-15561
Malicious code in techportal (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3) package.json declares a preinstall hook (`node beacon.js`) that fires automatically on `npm install`. beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), base32-encodes them, and issues an HTTP GET to a hardcoded bare-IP callback URL http://45.76.249.245/beacon/<token>/techportal/4.0.10, carrying the values in X-Bug-Bounty-Host, X-Bug-Bounty-User, and X-Bug-Bounty-Path headers. If the HTTP beacon fails or times out, the same identifiers are packed as base32-encoded DNS subdomain labels and queried (resolve4/resolve6/resolveTxt) against three hardcoded `*.oob.asm5.net` collector domains, providing a DNS-tunneling channel that bypasses HTTP egress controls. Destination is not caller-configurable and there is no install-time opt-in. Self-labeling of the beacon as an authorized bug bounty or dual-use tool does not change the data flow: installer host identity leaves the installer's machine on `npm install` to hardcoded attacker-operated infrastructure.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for techportal (npm). Pin to a known-safe version or switch to an alternative.