Malicious code in stillm4ddpocs-rtest-alpha (npm)

The npm package stillm4ddpocs-rtest-alpha version 999.9.9 was published with a preinstall hook that automatically executed on installation. The hook collected sensitive system information including the installer's local and public IPv4 addresses, DNS resolver IP, hostname, OS username, home directory, current working directory, and metadata from the parent project's package.json (name, author, repository, homepage).\n\nThe collected data was transmitted to a hardcoded callback domain (da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun) via three separate channels: HTTP POST on port 80, HTTPS POST on port 443, and DNS TXT queries with hex-encoded payloads split into 60-character chunks. The use of DNS as a covert channel was specifically designed to bypass egress filtering that blocks outbound HTTP traffic.\n\nThe package's self-description claimed it was for "authorised security research," but this disclaimer did not prevent execution; any project resolving the package name at install time would transmit data without explicit user consent. The version number (999.9.9) and package name are consistent with a dependency-confusion attack probe.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-14377).