MAL-2026-16071 Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code (index.js is an 87-byte stub), and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload executes twice during npm install before any application code. The script resolves a DNS canary and POSTs to a webhook.site collector; 99.1.0 additionally sends os.userInfo().username and os.hostname(). The author labels this a PoC, but the beacon fires on any install that resolves the package and exfiltrates a username usable for follow-on attacks, and dependency-confusion packages require incident response even when trivial.

Package [email protected] declares both preinstall and postinstall lifecycle hooks in package.json that execute scripts/run.js on every npm install. The script unconditionally issues a DNS lookup against d22d92dc-84e5-4b58-8cd6-75bf1ac452c7.dnshook.site and POSTs a JSON beacon containing the installer's hostname and process context to https://webhook.site/d22d92dc-84e5-4b58-8cd6-75bf1ac452c7. The package description self-identifies as a dependency-confusion PoC, and the 99.0.0 version is consistent with a resolution-winning squat targeting an internal package name. Installing the package results in arbitrary code execution on the installer host and fingerprints the machine to third-party out-of-band collectors under the operator's control.