MAL-2025-5455 Malicious code in red-bull-venue-tools (npm)

The package communicates with a domain associated with malicious activity.

package.json declares preinstall=node index.js, which fires automatically on npm install. index.js collects host reconnaissance — os.hostname(), os.platform()/arch, os.homedir(), os.userInfo() (username/uid/gid/shell), whoami and id shell command output via child_process.exec, OS info, and cwd — and POSTs the JSON payload to a hardcoded Burp Collaborator OAST subdomain at https://theyfiesr9w2p5moyrr9yn6lscy3mvak.oastify.com/detox56. The package name impersonates a Red Bull brand namespace, consistent with a targeted reconnaissance / dependency-confusion probe against an internal Red Bull build environment. Installer harm is concrete: every npm install of this version leaks installer identity and host fingerprint to an attacker-controlled out-of-band destination.