MAL-2026-12483 Malicious code in tracker-radar-detector (npm)
Malicious package
Published
MAL-2026-12483 is a malicious package: tracker-radar-detector (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12483/ (Markdown: https://insights.sbomify.com/MAL-2026-12483/index.md)
- Package
- tracker-radar-detector
- Registry
- npm
What is MAL-2026-12483?
MAL-2026-12483 is a malicious package in tracker-radar-detector, published on 5 Aug 2026.
Official description
package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, DNS server list, and current working directory, and reads /etc/passwd and /etc/hosts when present, then HTTPS POSTs the combined payload to a Burp Collaborator subdomain at mka6p95xmnkfcmdxv8cb4h2rpivej47t.oastify.com. Execution is automatic on install with no consumer interaction, and the destination is an out-of-band callback host unrelated to any legitimate tracker/detector functionality.
What should I do about MAL-2026-12483?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.