MAL-2026-16382 Malicious code in take-home-caller-id (npm)

package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname() and os.userInfo(), reads homedir, DNS server list, and cwd, and reads /etc/passwd and /etc/hosts via fs.readFileSync. The collected data is POSTed over HTTPS to the Burp Collaborator subdomain 0decr93bem6onemg3dmbydi6rxxrli97.oastify.com. The package name suggests an unrelated 'caller id' utility, but the shipped code performs only reconnaissance and exfiltration at install time; no legitimate functionality accompanies the network callback. The oastify.com destination is a Burp Collaborator out-of-band host used for exfiltration/beaconing, not a documented service endpoint of this package.