Malicious code in ai-analyzer (npm)
The npm package ai-analyzer contained malicious code in preinstall.js and postinstall.js scripts that exfiltrated system information (hostname, username, platform, git credentials) and used Burp Collaborator for out-of-band reconnaissance. The package's analyzeEmail() function also silently forwarded user-supplied content to an attacker-controlled endpoint.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed ai-analyzer during the malicious period; any application using the package's analyzeEmail() function.
- Ecosystems
- Attack vectors
- Affected entities
- ai-analyzernpm package with malicious preinstall and postinstall scripts
The npm package ai-analyzer was found to contain malicious code designed for reconnaissance and data exfiltration. The preinstall.js script constructed a DNS query using the installer's hostname prefixed to a PortSwigger Burp Collaborator subdomain (xstm5ywkgkh0fi1694d2u9ykbbh25vtk.oastify.com), leaking system information including hostname, OS platform, Node.js version, and working directory to an attacker-controlled out-of-band service.\n\nThe postinstall.js script wrote sensitive host context to /tmp/ai-analyzer-logs/, including hostname, username, home directory, proxy environment variables, and git user credentials. Additionally, the package's advertised analyzeEmail() function unconditionally POSTs caller-supplied content to https://ai.calif-pentest.com/api/v1/ai-analyzer without any caller-configurable destination, silently forwarding analyzed message content to an attacker-controlled server.\n\nThe branding (calif-pentest.com) and use of Burp Collaborator are consistent with an offensive-security actor. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- ai-analyzer
- Domains
- xstm5ywkgkh0fi1694d2u9ykbbh25vtk.oastify.com
- ai.calif-pentest.com
Remediation
- Immediately uninstall ai-analyzer from all systems
- Audit npm install logs to identify when ai-analyzer was installed
- Assume compromise of any system that installed the package; rotate credentials (git, proxy, SSH keys) on affected hosts
- Review git history and commits for any suspicious activity on systems where ai-analyzer was installed
- Monitor for exfiltration of data to ai.calif-pentest.com and oastify.com
- Use npm audit to check for the malicious package in dependency trees
- Consider blocking ai-analyzer and similar typosquatting variants at the package manager level
Sources
- GitHub Advisory GHSA-v54f-w8mv-c6xf · GitHub Advisory Database
Cite this entry
"Malicious code in ai-analyzer (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-ai-analyzer-npm-1sdb0q
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @mohamed_nowisar/token3-check (npm)
The npm package @mohamed_nowisar/token3-check contained malicious code in preinstall, install, and postinstall lifecycle hooks that exfiltrated system and CI environment information to a third-party webhook endpoint without user consent.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in agora402-payment-utils (npm)
The npm package agora402-payment-utils contains malicious code that replaces caller-supplied recipient addresses with a hardcoded Ethereum wallet (0xA930Ca05ea5548aE8ea0817087833A96453BED08) in payment routing functions. Additionally, a postinstall script exfiltrates installer metadata to an external webhook without consent.
npmCompromised packageMalicious commit - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-thread (npm)
The npm package mutex-thread contained injected malicious code that spawns obfuscated dropper payloads, exfiltrates host reconnaissance data to Slack and Telegram, and executes remotely-controlled commands fetched from an Ethereum smart contract on Sepolia testnet.
npmCompromised packageMalicious commit