MAL-2026-6980 Malicious code in domains-billing-types (npm)

[email protected] executes node index.js from its postinstall lifecycle script. On install, index.js reads os.hostname() and os.userInfo().username and embeds them as subdomain labels in a DNS A-record lookup to <hostname>.<username>.aiwm5lowso4vtjynsoije5q4rvxmlf94.oastify.com (Burp Suite Collaborator, an out-of-band interaction server). The DNS resolution transmits the installer's host and user identity to an attacker-controlled OAST endpoint at install time, without consent. The package has anonymous authorship, an empty description ("Billing!"), and no real functionality — the name and shape are consistent with a dependency-confusion probe against an internal package namespace, with the DNS beacon confirming any successful resolution.

The OpenSSF Package Analysis project identified 'domains-billing-types' @ 99.91.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.