MAL-2026-14377 Malicious code in stillm4ddpocs-rtest-alpha (npm)

package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's local IPv4, public IP (via https://api.ipify.org, https://icanhazip.com, https://ifconfig.me), DNS-resolver IP, hostname, OS username, home directory, cwd, and the parent project's package.json name/author/repository/homepage, then transmits the JSON to the hardcoded callback da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun via three channels: HTTP POST on:80, HTTPS POST on:443, and DNS TXT queries whose labels carry the hex-encoded payload split into 60-character chunks. The DNS covert channel and hex chunking are structured to bypass egress filtering that blocks outbound HTTP. The package's self-description as 'authorised security research' does not gate execution; any project that resolves this name at install time transmits the data without consent. The 999.9.9 version and lure name are consistent with a dependency-confusion probe.