Malicious code in prism-registry (npm)

The npm package prism-registry was found to contain malicious code in its preinstall script. The package declares preinstall: \"node index.js\", which executes automatically when the package is installed via npm install.\n\nThe index.js script collects sensitive host identifiers including the system hostname, user information, home directory path, DNS servers, installation directory, and package.json contents. It also reads local system files /etc/passwd and /etc/hosts.\n\nThe collected data is aggregated into JSON and sent via HTTPS POST to a hardcoded Burp Collaborator subdomain (zjmjb1b5mnwtdcmzrsq6uj4bj2ptdj18.oastify.com), indicating attacker-controlled infrastructure for data exfiltration. The package contains no legitimate functionality beyond this reconnaissance and data theft behavior.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.", <parameter name="remediation">["Immediately uninstall prism-registry from all systems: npm uninstall prism-registry", "Audit npm install logs and package-lock.json to identify when and where the package was installed", "Assume compromise of any system that installed this package; review system logs for suspicious outbound HTTPS connections to oastify.com", "Rotate credentials and SSH keys on affected systems", "Monitor for unauthorized access using the exfiltrated system information (hostname, usernames, etc.)", "Review npm audit logs and consider implementing package allow-lists to prevent installation of unknown packages"]