MAL-2026-4265 Malicious code in @asavie/i18n (npm)

@asavie/[email protected] is a dependency-confusion package targeting an unclaimed npm scope. Its package.json declares a preinstall hook that runs node callback.js, which on npm install reads os.hostname() and the output of whoami (callback.js L23, L28) and transmits them to the attacker-controlled out-of-band collector d88r3mao12pqka8tg04gn4ychek66c3wj.oast.site (an Interactsh subdomain) via both a DNS A-record lookup and an https.get() request with the data base64url-encoded into the subdomain (callback.js L21, L37, L46). Version 99.0.0 and the squat on the @asavie scope are the canonical dependency-confusion shape — any build that mistakenly resolves this scope from public npm leaks identifying host data to the publisher. The tarball additionally ships an unrelated ~123 MB google-chrome-stable_current_amd64.deb that is not referenced by any code path; it is not executed but represents either staging or registry abuse. Author claims of 'authorized research' are unverifiable by installers and do not change the installer-side outcome: unsolicited exfiltration of host identifiers on npm install.

The OpenSSF Package Analysis project identified '@asavie/i18n' @ 99.0.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.