{"id":"MAL-2026-17766","summary":"Malicious code in @s4yhiitestpoc/scan-https-d (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea)\nOn `npm install`, postinstall.js collects installer host identity — os.hostname(), os.userInfo().username, home directory, cwd, non-internal network interface addresses, DNS servers, and platform/arch/release — and POSTs it as JSON over HTTPS to the hardcoded endpoint https://collector.oob.s4yhii.com/_npm-poc/beacon, with a secondary DNS lookup against *.oob.s4yhii.com as an out-of-band execution signal. The package's scope (`@s4yhiitestpoc/*`) and metadata self-describe this as a dependency-confusion proof-of-concept targeting internal namespaces that resolve to the public registry; the self-labeling does not change the fact that installer host identifiers leave the installer's machine on install to a hardcoded third-party domain the installer did not opt into.\n","modified":"2026-10-11T14:30:09.174128066Z","published":"2026-10-11T13:58:59Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021434","import_time":"2026-10-11T14:18:05.348764552Z","modified_time":"2026-10-11T13:58:59Z","sha256":"1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@s4yhiitestpoc/scan-https-d/v/1.0.0"}],"affected":[{"package":{"name":"@s4yhiitestpoc/scan-https-d","ecosystem":"npm","purl":"pkg:npm/%40s4yhiitestpoc/scan-https-d"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"fa51a75512b0237137f12ad0a84e54f5d322c3a6795979e4b18d02846bcb4fa42b62fb","path":"postinstall.js","sha256":"f23aca67400de96abcfaa7a7c0ef987ebe14cef43467110595c8abc4a51f532d"}],"package_integrity":[{"hashes":{"sha1":"f50c0ae29c524e0f135059f4c3779ed2906c2dd1","sha512_sri":"sha512-1xxUqIEv1UbxyZhi/GGYOFDfw1ezF4Ny8LGm/Vas2bWUU97X+dl/PrgOkV7zsbSazyk69DzGPuDw6lhN10jzbw=="},"filename":"scan-https-d-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@s4yhiitestpoc/scan-https-d/MAL-2026-17766.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}