MAL-2026-11518 Malicious code in exnesss (npm)
- Package
- exnesss
- Registry
- npm
What is MAL-2026-11518?
MAL-2026-11518 is a malicious package in exnesss, published on 4 Aug 2026.
Official description
Package name 'exnesss' typosquats 'exness'. The package.json declares scripts.postinstall: 'node./postinstall.js', and postinstall.js issues an HTTPS GET to a hardcoded Burp Collaborator subdomain (hteimcuxkeb6pacscuexz4d9y04rshg6.oastify.com) on every install. This fires automatically on npm install, contacting an out-of-band interaction host that reveals the installer's network/DNS metadata to the operator of that Collaborator instance. The package provides no advertised functionality to the installer beyond the beacon.
The OpenSSF Package Analysis project identified 'exnesss' @ 0.0.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
What should I do about MAL-2026-11518?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.