MAL-2026-15687 Malicious code in @yuva2210/okx-poc-rce-impact (npm)

@yuva2210/[email protected] is a dependency-confusion proof-of-concept targeting OKX's internal namespace. The package's package.json declares a preinstall script that runs on npm install and executes child_process.execSync calls for whoami, hostname, pwd, and id, collecting installer host and user identifiers and writing them to /tmp/okx-poc-rce-proof.json. The package has no other functional content — index.js is empty — so the tarball's only effect on installation is to execute the reconnaissance payload on the installer's machine. Any developer or build system that inadvertently resolves an OKX-internal name to this public package runs arbitrary code at install time. The self-labeled 'harmless PoC' framing does not change the mechanism: unsolicited command execution and host-identifier collection fire automatically on npm install.