MAL-2026-6366 Malicious code in backpack-ios (npm)
Malicious package
Published
MAL-2026-6366 is a malicious package: backpack-ios (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-6366/ (Markdown: https://insights.sbomify.com/MAL-2026-6366/index.md)
- Package
- backpack-ios
- Registry
- npm
What is MAL-2026-6366?
MAL-2026-6366 is a malicious package in backpack-ios, published on 24 Jun 2026.
Official description
package.json declares
"preinstall": "node index.js", causing index.js to execute automatically on npm install. The script collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers, cwd, full package.json) and reads /etc/passwd and /etc/hosts via fs.readFileSync, then HTTPS POSTs the JSON payload to xopalguac3nk3bb10x9r4t6q7hdd13ps.oastify.com — a Burp Collaborator (OAST) subdomain used for out-of-band data exfiltration. The package name mirrors Skyscanner's Backpack iOS design-system package while shipping a ~2KB exfil-only payload with empty author/description fields, consistent with a dependency-confusion / typosquat lure. Installing this package directly leaks installer host identity and local user account data to an attacker-controlled endpoint.What should I do about MAL-2026-6366?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.