MAL-2026-17699 Malicious code in @dransay/secrets (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/* namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name in the request; npm account 0xamino_hunter published it on 2026-10-08.

The package declares a preinstall script that runs beacon.js, which performs a DNS lookup and HTTPS GET to a hardcoded Interactsh collector host (db3klhbi6i9hark1kegg174t38h33b6wt.oast.site) at npm install time. Both the DNS query and the HTTPS request embed the package name, so any machine that resolves and installs this scoped name sends an unsolicited out-of-band callback carrying the installing host's source IP, resolver identity, timing, and the internal package name to a third-party collector. The implausibly high 99.0.0 version against a scoped name is the dependency-confusion shape — the artifact is intended to win resolution against an internal @dransay/secrets and beacon from whichever build environment resolves it, disclosing internal network and build-system identity. No functional library code accompanies the beacon; the package's only on-install effect is the callback.