Malicious code in aedes_clusters (npm)

The npm package aedes_clusters was found to contain malicious code executed via a preinstall hook in package.json. Upon installation, the hook automatically runs node index.js, which performs host reconnaissance and data exfiltration without user consent or knowledge.\n\nThe malicious index.js script collects sensitive host information including hostname, username, home directory path, and DNS server configuration. It also reads local system files such as /etc/passwd and /etc/hosts. All collected data is then exfiltrated via HTTPS POST requests to a hardcoded Burp Collaborator subdomain (b5hv16nakzo45px5ga4ukkum8de52vqk.oastify.com), which is an attacker-controlled out-of-band interaction service commonly used for data exfiltration.\n\nThe package contained no legitimate functionality; its sole purpose was host reconnaissance and data exfiltration at install time. The incident was identified and credited to the OpenSSF malicious-packages repository.