MAL-2026-17697 Malicious code in @dransay/logger (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/* namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name in the request; npm account 0xamino_hunter published it on 2026-10-08.

The package @dransay/[email protected] ships a preinstall hook (node beacon.js) that fires on npm install. The script performs a DNS lookup and HTTPS GET to the interactsh collaborator host db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, encoding the package name in the subdomain/path. The version number (99.0.0) is implausibly high for a package with no release history, consistent with a dependency-confusion squat intended to win semver resolution against a private internal name. On install, the beacon discloses the installer's source IP, DNS resolver, and timestamp to a third-party host under the scoped name @dransay/logger, confirming successful resolution of this public package in an environment that may have intended to resolve a private @dransay/* package. No further payload is executed in this version, but the install-time callback to an attacker-controlled OAST endpoint is the reconnaissance stage of a dependency-confusion attack.