action-slack-message-root

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba)
package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance — os.hostname(), os.platform(), os.arch(), os.release(), os.uptime(), os.cpus(), memory info, and the output of shell commands `whoami`, `id`, `pwd`, and `uname -a` via child_process — and POSTs the JSON payload over plain HTTP to a hardcoded Burp Suite Collaborator subdomain at http://x86cmb7n60gbagfm4fdws0nw5nbjzanz.oastify.com. The package name resembles legitimate Slack-notification tooling, but the shipped code performs only reconnaissance exfiltration with no advertised functionality. The tarball also declares an unpinned dependency on openmct-heatmap ^1.0.1, consistent with a dependency-confusion / research-probe shape.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/action-slack-message-root/MAL-2026-16323.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/action-slack-message-root/MAL-2026-16323.json
- https://www.npmjs.com/package/action-slack-message-root/v/1.0.1
- https://github.com/advisories/GHSA-48hx-h7cw-h342

Compromised versions (1)

• = 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.