Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

A malicious npm package was published under the internal-looking scope @usaa-grp-personal-profile with version 999.0.0, consistent with a dependency-confusion attack designed to target an organization's private npm registry. The package was discovered by Amazon Inspector and credited to the OpenSSF malicious-packages project.\n\nThe malicious code is embedded in preinstall and postinstall hooks that execute automatically during npm install. The beacon.js script reads sensitive system information including os.hostname(), os.userInfo().username, and process.cwd(), then hex-encodes these values into DNS labels and performs dns.lookup queries against a subdomain of oastify.com (a Burp Collaborator out-of-band service). This exfiltration occurs automatically without user invocation and transmits installer host, user, and working-directory identifiers to an attacker-controllable endpoint.\n\nThe attack is designed to identify which organizations or individuals attempt to install packages from the internal scope, enabling reconnaissance for further targeted attacks.