MAL-2026-17668 Malicious code in @dransay/address-validation (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/* namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name in the request; npm account 0xamino_hunter published it on 2026-10-08.

@dransay/[email protected] declares a preinstall script (node beacon.js) that fires on npm install and performs a DNS lookup plus HTTPS GET to a subdomain of the Interactsh collaborator service oast.site with the path /address-validation. The implausibly high version number (99.0.0) and the preinstall callback are consistent with a dependency-confusion probe: any environment resolving this name reveals its egress IP and the package name to the operator of the collaborator host. No installer secrets, environment variables, or filesystem contents are read; the beacon transmits only install metadata (source IP, package name, DNS resolver). No code is fetched or executed from the remote host, and no persistence is established.

The OpenSSF Package Analysis project identified '@dransay/address-validation' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.