Malicious code in online-header (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4b9cc23b20e29ff5e2382e8812e86048148646c43b844f6f73db4581e790f761) [email protected] is a dependency-confusion squat (name claimed at version 99.0.0 with an inert main entry) whose `preinstall` lifecycle script runs `node callback.js`. callback.js collects host identifiers — `os.hostname()`, `os.userInfo().username`, `__dirname` install path, Node version, `os.platform()` and `os.arch()` — and POSTs them via `https.request` to the hardcoded Burp Collaborator OAST endpoint `https://bixi2qq8pkzaq6byt1e037kuul0co2cr.oastify.com`, with a DNS-based backup channel to the same subdomain. On any build system that resolves `online-header` from the public registry (for example, an internal package of the same name shadowed by this public release), `npm install` automatically transmits the installer's host identity and internal install path to a third-party collector controlled by whoever provisioned the OAST subdomain. The package's self-description as a 'dependency-confusion test' does not change the behavior: installers receive no notice and no opt-out, and the data lands at an endpoint outside their control. ## Source: ossf-package-analysis (161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc) The OpenSSF Package Analysis project identified 'online-header' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Source published

1 Oct 2026 14:55:35 UTC

Source modified

4 Oct 2026 23:45:17 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.