MAL-2026-16299 Malicious code in @pwaplatform/module-sso-integration (npm)

@pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install. payload.js collects hostname, whoami, id, uname -a, the contents of /etc/passwd (up to 4096 bytes), cwd, INIT_CWD, the installing project's git remote and branch, its package.json metadata and top-level dependencies, npm config, CI environment variables, and node/platform information, base64/base64url-encodes the payload, and transmits it over plain HTTP to three hardcoded destinations: http://sobaka-kusaka.ru:8000/oob/<token>, http://sobaka-kusaka.ru:8898/c/<token>, and a Burp Collaborator subdomain at http://ii473egh1b4kbaw03rf7pkzik9q0er8fx.oastify.com/<token>. The @pwaplatform scope name, the implausibly high 99.0.1 version, and the out-of-band collaborator channel are consistent with a dependency-confusion attack against an internal scope; the README's 'authorized bug bounty canary' framing is author-controlled and does not reflect installer consent.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The OpenSSF Package Analysis project identified '@pwaplatform/module-sso-integration' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.