{"id":"MAL-2026-17764","summary":"Malicious code in @s4yhiitestpoc/r2-https (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b6042f718b39be380eeda7c31dc46b056e753cb8a39e51897c8106e49b44f4d0)\nOn npm install, the package's declared postinstall script (postinstall.js) collects installer host fingerprint data — hostname, username, home directory, platform/arch/OS release, current working directory, install directory, DNS server list, non-internal network interface addresses, Node.js version, and npm_* environment values including npm_config_registry — and POSTs the collected JSON to https://collector.oob.s4yhii.com/_npm-poc/beacon. It additionally performs an out-of-band DNS lookup against a subdomain of oob.s4yhii.com (db03o8lag74hsugsg2j091t8mfcf437h3.oob.s4yhii.com) to confirm execution via DNS exfiltration. The destination is a hardcoded author-controlled domain, the behavior fires automatically at install time without consent, and the exfiltrated data includes npm_config_registry which can disclose an internal/private registry URL. A self-described 'PoC' or 'coordinated disclosure' framing does not change the fact that installer-identifying data and internal registry configuration leave the host to a third-party endpoint.\n","modified":"2026-10-11T14:30:08.356963213Z","published":"2026-10-11T13:58:38Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-11T14:18:05.109109739Z","modified_time":"2026-10-11T13:58:38Z","sha256":"b6042f718b39be380eeda7c31dc46b056e753cb8a39e51897c8106e49b44f4d0","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021432"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@s4yhiitestpoc/r2-https/v/1.0.0"}],"affected":[{"package":{"name":"@s4yhiitestpoc/r2-https","ecosystem":"npm","purl":"pkg:npm/%40s4yhiitestpoc/r2-https"},"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"r2-https-1.0.0.tgz","hashes":{"sha1":"d1a8b275e389057883bb2fa12409bde2ebd59390","sha512_sri":"sha512-ZpQdStXjoP5SqnkktnODPZmkHtRAqmO9V+9OPYYTz1KvdzyVtFTXu+KtbV4NA6soinG2FB08rhVCqN8P4tg8hg=="}}],"evidence_files":[{"tlsh":"1871a56619b4063227e52ee169862094972ac767791cbae0721e13485fce1be40f13ff","path":"postinstall.js","sha256":"4e1c182ebf45e34a28a3e7b757eb8442d3b307372dbbc0d2b50898c03fb738d6"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@s4yhiitestpoc/r2-https/MAL-2026-17764.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}