take-home-caller-id

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (a1adcf7c4b091ee35e021af3f4f886f5c8cc6f34b255315ab9767c3fdda5dcfe)
package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname() and os.userInfo(), reads homedir, DNS server list, and cwd, and reads /etc/passwd and /etc/hosts via fs.readFileSync. The collected data is POSTed over HTTPS to the Burp Collaborator subdomain 0decr93bem6onemg3dmbydi6rxxrli97.oastify.com. The package name suggests an unrelated 'caller id' utility, but the shipped code performs only reconnaissance and exfiltration at install time; no legitimate functionality accompanies the network callback. The oastify.com destination is a Burp Collaborator out-of-band host used for exfiltration/beaconing, not a documented service endpoint of this package.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/93f5690fa3407c473772bcaade41b8b92c4b22bd/osv/malicious/npm/take-home-caller-id/MAL-2026-16382.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/93f5690fa3407c473772bcaade41b8b92c4b22bd/osv/malicious/npm/take-home-caller-id/MAL-2026-16382.json
- https://www.npmjs.com/package/take-home-caller-id/v/1.0.1
- https://github.com/advisories/GHSA-2g3j-m32f-cc29

Compromised versions (1)

• = 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.