MAL-2026-5327 Malicious code in @listings/energy-labels (npm)

The package declares "preinstall": "node index.js || true" in package.json, so on every npm install the script executes automatically and silently swallows errors. index.js collects host identity (os.hostname(), os.userInfo().username, __dirname, process.cwd(), package label), hex-encodes the JSON payload as a DNS subdomain of d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live (an out-of-band interaction service used for exfiltration), and additionally POSTs the same payload over plain HTTP to a hardcoded bare IP http://172.201.213.59:9090/c. There is no TLS, no authentication, no documented purpose, and the bare-IP plus OOB DNS pattern is consistent with dependency-confusion / supply-chain reconnaissance infrastructure. Installer machines are fingerprinted and reported to the attacker on install with no user consent.

The OpenSSF Package Analysis project identified '@listings/energy-labels' @ 99.0.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.