MAL-2026-15589 Malicious code in autobahn-electron-probe (npm)

package.json declares preinstall and postinstall lifecycle scripts that run curl against http://da9ohqqvbsgu1166tuu0rrroxsztr18dt.cyowl.com/autobahn-electron-probe/, sending the installer's username (whoami), hostname, current working directory, and a timestamp as query parameters over plain HTTP. The long unique subdomain under cyowl.com is a DNS-callback / OAST-style exfiltration pattern. The scripts fire automatically on npm install without any user action, and the package ships no functional module code — the lifecycle beacon is the entire payload. The package name resembles the Autobahn WebSocket project and Electron, but the shipped contents perform only host reconnaissance and beaconing.

The OpenSSF Package Analysis project identified 'autobahn-electron-probe' @ 99.99.1 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.