MAL-2026-16006 Malicious code in vishal_312pkg (npm)

package.json declares a preinstall lifecycle script that runs on npm install and issues a wget request to https://webhook.site/ea0ca859-424d-4cc5-9210-62f7e25692a1/ carrying the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as querystring parameters. The destination is a third-party request-inspection collector hardcoded in the manifest, unrelated to any documented package purpose. This is the canonical dependency-confusion / reconnaissance beacon shape: automatic execution at install time, unconditional outbound network to an attacker-controlled endpoint, and disclosure of installer host identifiers that identify internal environments and users.

The OpenSSF Package Analysis project identified 'vishal_312pkg' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.