MAL-2026-5427 Malicious code in @payment-review/store (npm)

package.json declares preinstall: node index.js || true, so installing the package automatically runs index.js on npm install. The script collects host identity fields — os.hostname(), os.userInfo().username, __dirname, process.cwd(), and the package id — serializes them as JSON, and exfiltrates them via two channels: (1) an HTTP POST to the hardcoded bare IP http://172.201.213.59:9090/c, and (2) a hex-encoded DNS resolution against a subdomain of d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live (Interactsh out-of-band exfiltration). The package metadata (@payment-review/store, version 99.0.0, description security research, no real functionality) matches the dependency-confusion shape: a high version number under a target-org-styled scope intended to override an internal private package of the same name. Installing this package leaks the installer's host and user identity to attacker-controlled infrastructure with no user consent.