MAL-2026-11158 Malicious code in blots (npm)

package.json defines preinstall and postinstall lifecycle scripts that unconditionally run curl against a hardcoded webhook.site endpoint, transmitting the installer's username (whoami), hostname, current working directory, and timestamp as query parameters. The endpoint is a third-party request-capture service controlled by the author (https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e/blots). The package ships no other functionality tied to a documented purpose; the sole install-time effect is reconnaissance of the installer's host and identity to an attacker-controlled destination.

The OpenSSF Package Analysis project identified 'blots' @ 2.1.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.