MAL-2026-5419 Malicious code in @nstrlabs/auth (npm)

On npm install, the package's preinstall hook (node index.js || true, declared in package.json) automatically collects host identifiers — os.hostname(), os.userInfo().username, __dirname, and process.cwd() — and exfiltrates them through two channels: (1) a DNS lookup to a hex-encoded subdomain of d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live (an out-of-band interaction canary), and (2) an HTTP POST of the JSON payload to the bare IP 172.201.213.59 on port 9090 at path /c. The package ships no other functionality; the entire codebase is a beacon. Combined with the implausible version 99.0.0, the @nstrlabs scope, and the self-described 'security research' purpose, this has the canonical shape of a dependency-confusion attack against a private @nstrlabs/auth namespace, where any organization that mistakenly resolves the public registry copy will leak internal hostnames and developer identities to the attacker.