Malicious code in @s4yhiitestpoc/r2-https (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b6042f718b39be380eeda7c31dc46b056e753cb8a39e51897c8106e49b44f4d0) On npm install, the package's declared postinstall script (postinstall.js) collects installer host fingerprint data — hostname, username, home directory, platform/arch/OS release, current working directory, install directory, DNS server list, non-internal network interface addresses, Node.js version, and npm_* environment values including npm_config_registry — and POSTs the collected JSON to https://collector.oob.s4yhii.com/_npm-poc/beacon. It additionally performs an out-of-band DNS lookup against a subdomain of oob.s4yhii.com (db03o8lag74hsugsg2j091t8mfcf437h3.oob.s4yhii.com) to confirm execution via DNS exfiltration. The destination is a hardcoded author-controlled domain, the behavior fires automatically at install time without consent, and the exfiltrated data includes npm_config_registry which can disclose an internal/private registry URL. A self-described 'PoC' or 'coordinated disclosure' framing does not change the fact that installer-identifying data and internal registry configuration leave the host to a third-party endpoint.

Source published

11 Oct 2026 13:58:38 UTC

Source modified

11 Oct 2026 14:30:08 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.