Malicious code in @cats-cdf/browser-metrics-meter (npm)

The npm package @cats-cdf/browser-metrics-meter was found to contain malicious code embedded in its preinstall lifecycle script. Upon installation via npm install, the script automatically executed commands to gather system reconnaissance information.\n\nThe malicious script executed whoami and hostname commands, then fetched the machine's public IP address from ifconfig.me. All three values were transmitted as query-string parameters to a hardcoded out-of-band interaction domain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun) over plain HTTP using curl, with wget as a fallback mechanism.\n\nThe target domain is an OAST (out-of-band application security testing) collector designed to receive exfiltrated reconnaissance data. The malicious behavior executed unconditionally with no first-party relationship, user consent, or documented purpose consistent with the package's stated function as a browser metrics meter.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.