MAL-2026-4614 Malicious code in moneykit-cardano-demo (npm)

package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects host identifiers and OS files — os.hostname(), os.userInfo().username, home directory, DNS servers, /etc/passwd, /etc/hosts, and the consumer's full package.json — and HTTPS-POSTs the JSON payload to bixf8sa9rawbznh6ivppxl7k1b72vtji.oastify.com, a Burp Collaborator subdomain. The package ships no functionality matching its name; metadata is empty (no author, description, or license). The name moneykit-cardano-demo resembles an internal/private namespace and is consistent with a dependency-confusion reconnaissance package targeting an organization's internal scope. Installer harm: every npm install of this package leaks host identity, the local user account, OS-level files (/etc/passwd, /etc/hosts), and the consumer project's package.json contents to the attacker, providing target identification and the foothold data needed for follow-on attacks.