MAL-2025-889 Malicious code in x509-escaping (npm)

package.json declares preinstall: node index.js, so on npm install the shipped index.js runs automatically. It collects hostname, username, home directory, DNS servers, and current working directory, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then POSTs the bundle over HTTPS to the hardcoded host agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com (a Burp Collaborator out-of-band subdomain). The package name and single-purpose recon payload match the dependency-confusion reconnaissance pattern: no library functionality is shipped, only install-time data exfiltration to an attacker-controlled OOB host.