MAL-2026-14411 Malicious code in dpg-media-7ehemel (npm)

npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment context and beacons it to the hardcoded host da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun. The script collects os.hostname(), username/home/cwd/INIT_CWD, local and public IP addresses (via https.get to api.ipify.org / icanhazip.com / ifconfig.me), resolver IPs, and CI metadata (repo, actor, run id, workflow, AWS region), and spawns gh api user --jq.login, npm whoami, and git config user.email to attribute the environment to a specific developer/org, plus reads parent project package.json fields. The payload is serialized as JSON, hex-encoded, chunked to 60-character DNS labels, and exfiltrated both via dns.resolve subdomain queries (${i}-${c}.u-${uuid}.<callback>) and via HTTP/HTTPS POST to /poc/${uuid} on the same callback host. The version string 999.9.15 and the developer-identity harvest are characteristic of a dependency-confusion beacon targeting a private-scope name. Any self-description as authorized research is contradicted by the DNS-tunneling exfiltration channel and the absence of installer consent.

The OpenSSF Package Analysis project identified 'dpg-media-7ehemel' @ 999.9.15 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.