# MAL-2026-17420: Malicious code in online-header (npm)


- **Type:** Malicious package
- **Package:** `online-header` (npm)
- **Published:** 1 Oct 2026

## What is MAL-2026-17420?

MAL-2026-17420 is a malicious package in online-header, published on 1 Oct 2026. 

### Official description

online-header@99.0.0 is a dependency-confusion squat (name claimed at version 99.0.0 with an inert main entry) whose `preinstall` lifecycle script runs `node callback.js`. callback.js collects host identifiers — `os.hostname()`, `os.userInfo().username`, `__dirname` install path, Node version, `os.platform()` and `os.arch()` — and POSTs them via `https.request` to the hardcoded Burp Collaborator OAST endpoint `https://bixi2qq8pkzaq6byt1e037kuul0co2cr.oastify.com`, with a DNS-based backup channel to the same subdomain. On any build system that resolves `online-header` from the public registry (for example, an internal package of the same name shadowed by this public release), `npm install` automatically transmits the installer's host identity and internal install path to a third-party collector controlled by whoever provisioned the OAST subdomain. The package's self-description as a 'dependency-confusion test' does not change the behavior: installers receive no notice and no opt-out, and the data lands at an endpoint outside their control.

The OpenSSF Package Analysis project identified 'online-header' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

## What should I do about MAL-2026-17420?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17420 is a malicious package: online-header (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17420/ (Markdown: https://insights.sbomify.com/MAL-2026-17420/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17420

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17420/
Summaries are generated and may contain mistakes; the official description above is the record.