MAL-2026-14019 Malicious code in fr-ito-web-react (npm)

Package's package.json declares both preinstall and postinstall lifecycle hooks that execute node exfil.js on npm install. exfil.js runs whoami and id via child_process.execSync and transmits the output to the hardcoded host d9vbd1vstrb04vgt4dqg63k7yg55jhmt5.oast.site over HTTPS POST with TLS verification disabled (rejectUnauthorized: false), with a DNS lookup fallback that encodes the whoami output as a hex subdomain of the same collector. The package uses version 99.99.99, a typical dependency-confusion cover version to force resolution over an internal package of the same name. Installer identity and host data leaves the machine to an attacker-controlled interactsh/OAST collector without user interaction.

The OpenSSF Package Analysis project identified 'fr-ito-web-react' @ 99.99.99 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.