MAL-2026-4270 Malicious code in clickpy (npm)

On require('clickpy'), index.js collects host metadata via os.hostname(), os.userInfo(), os.platform(), os.arch(), process.cwd(), process.pid, and the current time, then issues an HTTPS GET to the hardcoded out-of-band host fxpkkxatijbbyxuhdclqssj033zarohm1.oast.fun with these values as query-string parameters (index.js:4 and index.js:25-29). oast.fun is the interactsh/OAST collaborator service used to receive callbacks from victim hosts; there is no legitimate purpose for a published library to beacon installer identifiers to such a host on import. Package metadata is empty (no description, no author), consistent with a throwaway recon/PoC exfiltration package.

The OpenSSF Package Analysis project identified 'clickpy' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.