# MAL-2026-12483: Malicious code in tracker-radar-detector (npm)


- **Type:** Malicious package
- **Package:** `tracker-radar-detector` (npm)
- **Published:** 5 Aug 2026

## What is MAL-2026-12483?

MAL-2026-12483 is a malicious package in tracker-radar-detector, published on 5 Aug 2026. 

### Official description

package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, DNS server list, and current working directory, and reads /etc/passwd and /etc/hosts when present, then HTTPS POSTs the combined payload to a Burp Collaborator subdomain at mka6p95xmnkfcmdxv8cb4h2rpivej47t.oastify.com. Execution is automatic on install with no consumer interaction, and the destination is an out-of-band callback host unrelated to any legitimate tracker/detector functionality.

## What should I do about MAL-2026-12483?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-12483 is a malicious package: tracker-radar-detector (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-12483/ (Markdown: https://insights.sbomify.com/MAL-2026-12483/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-12483

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-12483/
Summaries are generated and may contain mistakes; the official description above is the record.