MAL-2026-16175 Malicious code in csa-mfa (npm)

package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command substitution of whoami, ls, and hostname. On npm install this automatically transmits the installer's username, current-directory listing, and hostname to a hardcoded bare-IP HTTP endpoint unrelated to any legitimate publisher infrastructure. There is no functional package purpose served by this behavior.

The OpenSSF Package Analysis project identified 'csa-mfa' @ 1.1.16 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.