MAL-2026-16126 Malicious code in strapi-plugin-vinsoc-1109 (npm)

The package's postinstall lifecycle script (node postinstall.js || true) fires automatically on npm install. postinstall.js reads os.hostname(), embeds the sanitized value as a subdomain of the hardcoded host 1bdtwmd0wdrpwnlput1up9x39ufl3br0.oastify.com (a Burp Collaborator out-of-band collector), and performs both a DNS lookup and a plain-HTTP GET to /poc/<hostname> at that host. The result is silent transmission of the installer's machine identifier to an attacker-controlled OOB endpoint on every install, with errors swallowed so the install does not visibly fail. The package name and version resemble a scoped Strapi plugin but the shipped payload performs no plugin functionality — only the beacon.

The OpenSSF Package Analysis project identified 'strapi-plugin-vinsoc-1109' @ 3.6.8 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.