MAL-2026-4193 Malicious code in private-next-pages (npm)

package.json declares a postinstall script that uses Node's child_process to execute reconnaissance commands (including whoami) and beacon results out via HTTPS. The script contacts https://api.ipify.org to resolve the installer's public IP, reads process.env, and sends data to an .oast.fun host — the Project Discovery interact.sh out-of-band testing service used as a generic exfiltration sink. On npm install, this fires automatically and leaks host identity, network egress IP, and environment variables to an attacker-controlled collector. There is no legitimate reason for a Next.js page utility package to perform host fingerprinting or beacon to an OOB interaction service at install time.

The OpenSSF Package Analysis project identified 'private-next-pages' @ 9.0.5 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.