MAL-2026-4263 Malicious code in secdriven (npm)

On npm install, postinstall.js executes whoami via child_process and reads os.hostname(), os.platform(), the working directory, and CI / GITHUB_REPOSITORY environment variables, then transmits them as query-string parameters in an HTTPS GET to a hardcoded interactsh subdomain (lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com) under the path /google/secdriven/. A DNS lookup using whoami output as a subdomain provides a fallback exfiltration channel. The package description ("Security research canary — Google") and README pointing at a Google CTF internal package.json indicate this is a dependency-confusion payload targeting Google's internal namespace; any installer whose resolver picks up this public name leaks host identity, username, working directory, and CI repository path to the third-party OOB-detection endpoint without consent. Whether published as research or attack, the installer-side effect is the same: unconsented identity-and-environment beacon at install time.

The OpenSSF Package Analysis project identified 'secdriven' @ 1.0.8 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.