MAL-2026-5411 Malicious code in @klapp-about/routes (npm)

On npm install, the package's preinstall hook (node index.js) collects host and user identity data — os.hostname(), os.userInfo().username, __dirname, process.cwd(), pid, node version, platform, and architecture — and ships them to two attacker-controlled destinations: (a) an HTTP POST to a bare IP http://172.201.213.59:9090/cb/klapp-about-routes carrying the collected fields as JSON, and (b) a hex-encoded DNS lookup to *.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live (interactsh out-of-band callback). The package name @klapp-about/routes and the unusually high version 99.0.0 are the canonical shape of a dependency-confusion attack — an internal-looking scope published to public npm at a version high enough to override a private resolver. Self-description as a 'security research / dependency-confusion PoC' does not change installer-side impact: any developer or CI system that misroutes installs to the public registry has their machine fingerprint shipped to the hardcoded IP and DNS callback service without consent.