{"id":"MAL-2026-17766","revision":"cfdbd1455cbc44d497b2dda74bdb5a62","records":[{"revision":"cfdbd1455cbc44d497b2dda74bdb5a62","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17766","aliases":[],"title":"Malicious code in @s4yhiitestpoc/scan-https-d (npm)","description":"Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers (hostname, username, home directory, network interface addresses, platform details and npm configuration) to collector.oob.s4yhii.com, with a secondary DNS lookup under oob.s4yhii.com. The script states it is bug-bounty research and does not read secrets or file contents. Any machine that installed this package disclosed the listed host information to a third party.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea)\nOn `npm install`, postinstall.js collects installer host identity — os.hostname(), os.userInfo().username, home directory, cwd, non-internal network interface addresses, DNS servers, and platform/arch/release — and POSTs it as JSON over HTTPS to the hardcoded endpoint https://collector.oob.s4yhii.com/_npm-poc/beacon, with a secondary DNS lookup against *.oob.s4yhii.com as an out-of-band execution signal. The package's scope (`@s4yhiitestpoc/*`) and metadata self-describe this as a dependency-confusion proof-of-concept targeting internal namespaces that resolve to the public registry; the self-labeling does not change the fact that installer host identifiers leave the installer's machine on install to a hardcoded third-party domain the installer did not opt into.\n","state":0,"publishedAt":"2026-10-11T13:58:59+00:00","modifiedAt":"2026-10-13T23:45:04.8501393+00:00","affected":[{"ecosystem":"npm","name":"@s4yhiitestpoc/scan-https-d","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@s4yhiitestpoc/scan-https-d/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17766","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17766","identifiers":["MAL-2026-17766"]},"retained":false,"historicalAffected":[]}],"coverage":[]}