Note: This report is updated by a verification record
Malicious package due to data exfiltration, command execution, and suspicious install scripts. Gathers system info and sends it to a remote server.
The package is marked as malware by OSV: MAL-2026-1382 with source: amazon-inspector
Note: This report is updated by a verification record
The package exhibits multiple strong indicators of malicious behavior. The callback.js file gathers sensitive system information (hostname, OS details, IP addresses, DNS servers, etc.) and attempts to exfiltrate this data via HTTP POST/GET requests and DNS queries to a suspicious IP address (168.220.234.152). It also executes shell commands using execSync, allowing arbitrary code execution. Furthermore, the package.json includes preinstall and postinstall scripts that execute callback.js, enabling code execution during installation. The combination of information gathering, data exfiltration, command execution, and installation script abuse strongly suggests malicious intent. The project also has very few published versions, which increases the risk.
