Note: This report is updated by a verification record
The package is a malware because it exfiltrates username and hostname via a preinstall script using curl to an external server.
The package is marked as malware by OSV: MAL-2026-260 with source: amazon-inspector
Note: This report is updated by a verification record
The package contains a preinstall script in package.json that gathers the username and hostname, and then attempts to send this data to an external server using curl. This behavior is highly suspicious and indicative of malicious intent. The combination of npm_preinstall_command, npm_preinstall_curl, exfil_whoami_hostname YARA rules and the LLM analysis confirms the exfiltration attempt.
