MAL-2026-5288 Malicious code in uisp-connector (npm)

package.json declares preinstall: node index.js || true, causing index.js to run automatically on npm install. index.js issues a DNS resolution and HTTPS GET to a unique subdomain under oast.online (an Interactsh out-of-band collection server). The callback reveals the installer's resolver IP, egress IP, and the fact that an internal build system fetched a package matching this name — the canonical dependency-confusion exfiltration signal. The README self-identifies the package as security research, and the version string contains security-research, but an installer cannot distinguish authorized research from real exploitation: the network beacon and information disclosure happen identically in both cases, and whoever controls the Interactsh subdomain receives the data.

The OpenSSF Package Analysis project identified 'uisp-connector' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.