MAL-2026-6254 Malicious code in zomato-sushi (npm)

package.json declares a preinstall script that runs curl with form-encoded fields carrying the installer's hostname (hostname -f), whoami, current working directory, and a base64-encoded dump of the entire process environment (env | base64 -w0) over plain HTTP to an Interactsh/OAST out-of-band collector at d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site. A preuninstall hook beacons the same host. This fires automatically on npm install with no user opt-in. The bulk environment dump captures any secrets present in the shell at install time, including CI tokens, NPM_TOKEN, AWS_* keys, and similar credentials. The package name mimics Zomato's design system namespace and the shipped index.js is a stub with no functionality, consistent with a reconnaissance/credential-capture lure rather than a real library.

The OpenSSF Package Analysis project identified 'zomato-sushi' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.