MAL-2026-11427 Malicious code in pp-react-worldready (npm)

package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads os.hostname() and CI/GitHub Actions environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID), and sends them as query parameters to a hardcoded webhook.site collector at https://webhook.site/1b840cbf-f1a4-4d79-bf11-f1ef62949110. It also performs a DNS lookup embedding the hostname as a subdomain of your-collab-domain.oastify.com (Burp Collaborator) as an out-of-band exfiltration channel. This is the canonical dependency-confusion reconnaissance beacon shape: identify internal build hosts that mistakenly resolve the package name from the public registry.

The OpenSSF Package Analysis project identified 'pp-react-worldready' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.