MAL-2026-15923
Malicious code in line-through (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60) The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP (via api.ipify.org), OS hostname, and GitHub Actions / CI environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, and related identifiers), then sends them as query parameters in an HTTPS GET to a hardcoded collector at https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d. It also performs a DNS lookup encoding the hostname as a subdomain of an out-of-band collaborator domain (left as the placeholder your-collab-domain.oastify.com). Behavior fires automatically on npm install with no user interaction.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for line-through (npm). Pin to a known-safe version or switch to an alternative.