MAL-2026-11064 Malicious code in page-navigation (npm)

On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home directory, DNS server list, __dirname, package.json contents, and the contents of /etc/passwd and /etc/hosts, and HTTPS-POSTs the collected data to a hardcoded Burp Collaborator subdomain at 0ef84h7vro1unpywu477drayyp4gs8gx.oastify.com. The behavior fires automatically on default install with no user interaction and targets installer-side system files and identifiers rather than the package's declared purpose.

The OpenSSF Package Analysis project identified 'page-navigation' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.