Malicious code in stillm4ddpocs-rtest-bravo (npm)

The npm package stillm4ddpocs-rtest-bravo contained a malicious preinstall script (declared in package.json as scripts.preinstall = 'node index.js') that automatically executed when the package was installed via npm.\n\nThe script collected sensitive system and project information including hostname, username, home directory, local IPv4 address, the INIT_CWD environment variable, and the public egress IP (queried from api.ipify.org, icanhazip.com, and ifconfig.me). It also read the consuming project's package.json to extract the package name, author, repository, and homepage—effectively identifying which internal package name resolved to this public package.\n\nThe collected data was exfiltrated via two channels: HTTPS POST requests to da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun/poc/ and DNS queries with hex-encoded, chunked payloads as DNS labels, providing a fallback exfiltration method when outbound HTTP traffic is filtered.\n\nAlthough the package was described as a dependency-confusion research proof-of-concept, the malicious behavior transmitted installer host and parent-project identifiers to a third-party collector without consent. The incident was identified by the OpenSSF and documented in their malicious-packages repository.", <parameter name="remediation">["Remove stillm4ddpocs-rtest-bravo from all project dependencies immediately", "Audit npm install logs and CI/CD pipelines to identify when and where this package was installed", "Review system logs on affected machines for suspicious outbound connections to da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun and DNS queries with unusual patterns", "Rotate credentials and secrets that may have been exposed on systems where the package was installed", "Implement npm package allowlisting or stricter dependency management to prevent installation of untrusted packages", "Monitor for similar dependency-confusion attacks by validating that internal package names do not resolve to public registries"]