MAL-2026-4634 Malicious code in osep-react-antd (npm)

package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host identifiers (os.hostname(), process.platform, arch, os.homedir(), os.userInfo() including uid/gid/username/shell, cwd) and the output of whoami and id via child_process, then POSTs the JSON payload to a hardcoded URL https://qtn11857tbs7r8jtj0bj2250xr3jrafz.oastify.com/detox56. The oastify.com host is Burp Suite Collaborator out-of-band infrastructure used to receive callbacks from compromised installers. The package name mimics React/Ant Design naming conventions and ships empty author/description/license metadata with no functional code beyond the beacon — the dependency-confusion squat shape. Installer harm: every npm install of this package leaks the installer's hostname, username, uid/gid, and shell to the attacker, identifying internal corporate environments and CI runners for follow-on targeting.