MAL-2026-14390 Malicious code in amundi-compare (npm)

[email protected] is published at an inflated version number consistent with dependency-confusion targeting of an internal package name. The package.json declares a preinstall hook (node index.js) that runs automatically on npm install. index.js collects hostname, OS user, home directory, current working directory, local IPv4 addresses, public egress IP (queried from api.ipify.org, icanhazip.com, and ifconfig.me), the DNS resolver IP and client subnet, and the parent project's package.json name/author/repository/homepage fields. The payload is transmitted through three parallel channels to the hardcoded callback host da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun: an HTTP POST, an HTTPS POST to /poc/<uuid>, and a DNS covert channel that hex-encodes the JSON, splits it into <=60-character chunks, and emits each chunk as a subdomain label under the callback domain. The DNS channel is designed to bypass egress filters that block outbound HTTP. The package labels itself as authorized security research, but the callback host is not installer-configured and the parent project's metadata is captured without consent.