{"id":"MAL-2026-17764","revision":"9b5481709ce342bd996d6f92677ff156","records":[{"revision":"9b5481709ce342bd996d6f92677ff156","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17764","aliases":[],"title":"Malicious code in @s4yhiitestpoc/r2-https (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b6042f718b39be380eeda7c31dc46b056e753cb8a39e51897c8106e49b44f4d0)\nOn npm install, the package's declared postinstall script (postinstall.js) collects installer host fingerprint data — hostname, username, home directory, platform/arch/OS release, current working directory, install directory, DNS server list, non-internal network interface addresses, Node.js version, and npm_* environment values including npm_config_registry — and POSTs the collected JSON to https://collector.oob.s4yhii.com/_npm-poc/beacon. It additionally performs an out-of-band DNS lookup against a subdomain of oob.s4yhii.com (db03o8lag74hsugsg2j091t8mfcf437h3.oob.s4yhii.com) to confirm execution via DNS exfiltration. The destination is a hardcoded author-controlled domain, the behavior fires automatically at install time without consent, and the exfiltrated data includes npm_config_registry which can disclose an internal/private registry URL. A self-described 'PoC' or 'coordinated disclosure' framing does not change the fact that installer-identifying data and internal registry configuration leave the host to a third-party endpoint.\n","state":0,"publishedAt":"2026-10-11T13:58:38+00:00","modifiedAt":"2026-10-11T14:30:08.3569632+00:00","affected":[{"ecosystem":"npm","name":"@s4yhiitestpoc/r2-https","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@s4yhiitestpoc/r2-https/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17764","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17764","identifiers":["MAL-2026-17764"]},"retained":false,"historicalAffected":[]}],"coverage":[]}