MAL-2026-16140
Malicious code in tracker-cloudflare (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4) The package's preinstall hook runs `node index.js`, which collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers, cwd) along with the contents of /etc/passwd and /etc/hosts, and POSTs the payload over HTTPS to the Burp Collaborator subdomain c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com. The package has empty description/author metadata and no legitimate functionality beyond this beacon. The exfiltration fires automatically on `npm install` before any consumer code runs.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for tracker-cloudflare (npm). Pin to a known-safe version or switch to an alternative.