{"schema_version":"1.9.0","id":"MAL-2026-17766","published":"2026-10-11T13:58:59Z","modified":"2026-10-13T23:45:04.850139260Z","summary":"Malicious code in @s4yhiitestpoc/scan-https-d (npm)","details":"Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers (hostname, username, home directory, network interface addresses, platform details and npm configuration) to collector.oob.s4yhii.com, with a secondary DNS lookup under oob.s4yhii.com. The script states it is bug-bounty research and does not read secrets or file contents. Any machine that installed this package disclosed the listed host information to a third party.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea)\nOn `npm install`, postinstall.js collects installer host identity — os.hostname(), os.userInfo().username, home directory, cwd, non-internal network interface addresses, DNS servers, and platform/arch/release — and POSTs it as JSON over HTTPS to the hardcoded endpoint https://collector.oob.s4yhii.com/_npm-poc/beacon, with a secondary DNS lookup against *.oob.s4yhii.com as an out-of-band execution signal. The package's scope (`@s4yhiitestpoc/*`) and metadata self-describe this as a dependency-confusion proof-of-concept targeting internal namespaces that resolve to the public registry; the self-labeling does not change the fact that installer host identifiers leave the installer's machine on install to a hardcoded third-party domain the installer did not opt into.\n","affected":[{"package":{"name":"@s4yhiitestpoc/scan-https-d","ecosystem":"npm","purl":"pkg:npm/%40s4yhiitestpoc/scan-https-d"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"f23aca67400de96abcfaa7a7c0ef987ebe14cef43467110595c8abc4a51f532d","tlsh":"fa51a75512b0237137f12ad0a84e54f5d322c3a6795979e4b18d02846bcb4fa42b62fb"}],"package_integrity":[{"filename":"scan-https-d-1.0.0.tgz","hashes":{"sha1":"f50c0ae29c524e0f135059f4c3779ed2906c2dd1","sha512_sri":"sha512-1xxUqIEv1UbxyZhi/GGYOFDfw1ezF4Ny8LGm/Vas2bWUU97X+dl/PrgOkV7zsbSazyk69DzGPuDw6lhN10jzbw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@s4yhiitestpoc/scan-https-d/MAL-2026-17766.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@s4yhiitestpoc/scan-https-d/v/1.0.0"}],"database_specific":{"iocs":{"domains":["collector.oob.s4yhii.com","oob.s4yhii.com"],"files":[{"digests":{"sha256":"f23aca67400de96abcfaa7a7c0ef987ebe14cef43467110595c8abc4a51f532d"},"paths":["package/postinstall.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://collector.oob.s4yhii.com/_npm-poc/beacon"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021434","import_time":"2026-10-11T14:18:05.348764552Z","modified_time":"2026-10-11T13:58:59Z","sha256":"1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SecOpsAI Research","contact":["https://secopsai.dev","https://blog.secopsai.dev/advisories/"],"type":"FINDER"}]}