MAL-2026-16326

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da) package.json declares both preinstall and postinstall running `node callback.js`, so the payload fires automatically on `npm install`. callback.js collects hostname, username, platform, cwd, home directory, network interfaces, uid/gid, CI/cloud provider fingerprints, and probes the working directory for credential files (.env,.npmrc,.yarnrc,.git/config,.docker/config.json, credentials, secrets.json). It also enumerates process.env keys and filters them against a broad credential-name regex set (token, secret, key, password, aws, azure, gcp, npm, ssh, private, credential, jwt, bearer, stripe, db, mysql, postgres, mongo, redis). The collected payload is POSTed to api.telegram.org via a hardcoded Telegram Bot API token and chat_id (1064260758). A secondary DNS-based side channel base64-encodes host/user/CI fields and issues a `dns.resolve` against a `<encoded>.dc-callback.example.com` subdomain as a fallback for environments that block HTTPS to Telegram. The package presents itself as a byted/commerce materials module and a `security research / dependency confusion PoC`; the self-label does not change that the traced behavior harvests installer host and credential reconnaissance and ships it off-host to attacker-controlled channels without consent.