MAL-2026-10733 Malicious code in idlive-document-capture-web (npm)

Package name typosquats the legitimate 'idlive' family and ships no library functionality. package.json declares a preinstall lifecycle hook ("preinstall": "node index.js") that auto-executes on npm install. index.js collects host reconnaissance — hostname, platform, arch, username, uid/gid, shell, homedir, cwd, and the output of whoami/id spawned via child_process — and POSTs the collected data as JSON to the hardcoded attacker-controlled endpoint https://koc9471aou79yxauab6in903uu0locc1.oastify.com/detox56. The oastify.com host is Burp Suite Collaborator, an out-of-band interaction service commonly used as an exfiltration sink. There is no legitimate purpose for this behavior; the package exists solely to beacon installer-side identifiers to the attacker's OAST subdomain at install time.