MAL-2026-10778 Malicious code in relativity-pdfjs-dist (npm)

package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname, username, current working directory, npm registry configuration, CI environment markers (CI, GITHUB_REPOSITORY, JENKINS_URL), and platform, base64-encodes the JSON, and sends it as an HTTPS GET query parameter to 9u4hlcu3febavvzbrqulpuwf66cy0qof.oastify.com, a Burp Collaborator out-of-band exfiltration endpoint. The package name resembles the legitimate pdfjs-dist package and the version number 99.9.9 is a dependency-confusion pattern intended to outrank an internal package of the same name.

The OpenSSF Package Analysis project identified 'relativity-pdfjs-dist' @ 5.8.2 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.