Malicious code in @eforms/forms-api (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e58d3810346fb211fd7ed78e8df88c774a79bb079537e10cd30baa26e5ef4740) The npm package @eforms/[email protected] is a scoped-name dependency-confusion lure with an inflated version number and an empty index.js stub. Its only functionality is a preinstall lifecycle script (preinstall.js) that runs automatically on `npm install`. The script reads os.hostname(), os.userInfo() (username and uid), process.cwd(), process.platform, process.arch, process.version, the CI environment flag, and other host identifiers, and transmits them out-of-band to two hardcoded attacker-controlled subdomains of oastify.com (Interactsh / Burp Collaborator OOB infrastructure) — specifically rpkfvtsptfrhcgbe62qg11ywjnpij6ma1cfpke.oastify.com and f6mk7lyjsuk3u1t49ypp9q2jbah15rtg.oastify.com — via both a DNS lookup of a data-bearing label and an HTTPS GET whose query string carries the collected fields. The combination of a scoped @eforms/* name, implausibly high version (99.0.0 to win internal-vs-public resolution races), empty library surface, and preinstall OOB beacon is the standard shape of an internal-scope dependency-confusion attack. Any build that resolves this scope from the public registry ships internal host identity to the attacker's OOB collector on install. ## Source: ossf-package-analysis (cbe6ac9c18c859c04807fb2bd866f2eda2b70a4aa2583096b7138ab2adc90540) The OpenSSF Package Analysis project identified '@eforms/forms-api' @ 2.0.0-SNAPSHOT (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Source published

25 Oct 2026 06:26:03 UTC

Source modified

26 Oct 2026 06:45:16 UTC

Observed here

26 Oct 2026 07:21:08 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.