MAL-2026-5459 Malicious code in @dktunited/anly-tracker-v2 (npm)
Malicious package
Published
MAL-2026-5459 is a malicious package: @dktunited/anly-tracker-v2 (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-5459/ (Markdown: https://insights.sbomify.com/MAL-2026-5459/index.md)
- Package
- @dktunited/anly-tracker-v2
- Registry
- npm
What is MAL-2026-5459?
MAL-2026-5459 is a malicious package in @dktunited/anly-tracker-v2, published on 9 Jun 2026.
Official description
scripts/postinstall.js runs unconditionally during
npm install and exfiltrates installer-side identifiers to an attacker-controlled out-of-band collector. The script fetches the installer's public IP from api.ipify.org, then collects os.userInfo().username, os.hostname(), process.cwd(), the package name, and the resolved IP, and transmits them to the hardcoded host xjaipnfhcpawuhzlgzkzub8mc0rqdiuyp.oast.fun (an Interactsh OOB collector) via two channels: a dns.lookup of a hex-encoded subdomain and an https.request to /poc carrying the JSON payload base64-encoded in an x-poc header. The package is published at version 99.99.99 — the canonical dependency-confusion squat marker designed to outrank any internal @dktunited/anly-tracker-v2 package by semver. Whether labeled a bug-bounty PoC by the author or not, it is live on the public registry and will harm any build system that resolves it.What should I do about MAL-2026-5459?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.