MAL-2026-17572 Malicious code in checkmate-remediation-assistant (npm)

[email protected] contains no functional code: its only behaviour is a preinstall script that runs node index.js on npm install. index.js collects the install directory, the user's home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends them as JSON in an HTTPS POST to 9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com, a Burp Collaborator endpoint. The npm account testneo7755 published it on 2026-10-05 and it was unpublished about two minutes later; the same account published with-cte the same day with the same index.js and a different Collaborator subdomain.

The package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname(), os.userInfo(), the home directory, DNS server configuration, __dirname, the local package.json, and the contents of /etc/passwd and /etc/hosts, then transmits the collected data over HTTPS to a hardcoded Burp Collaborator (oastify.com) subdomain (9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com). The destination is an out-of-band interaction server not associated with any declared publisher or documented package purpose, and the exfiltration fires automatically on default install without user interaction.