os-info-meeb322k

GHSA-5wwx-6p5f-p9vh

Malicious code in os-info-meeb322k (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (cf3b4f18f9d98ad0792f96d750aef64b390ae6a516d948457d1e78b1d3242ab8)
The package's postinstall lifecycle script runs unconditionally on npm install. It collects host identifiers (hostname, platform, architecture, kernel release, uid/gid, CPU count, memory) and internal network interface addresses, base64-encodes the payload, and POSTs it over plain HTTP to the hardcoded subdomain vml73pdk3ft3t434ssjycv4khbn2btzi.oastify.com — a Burp Collaborator (OAST) callback host used to confirm code execution on the installer. The package has no other functionality; its sole install-time effect is the outbound beacon carrying installer reconnaissance data to an attacker-controlled domain.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/os-info-meeb322k/MAL-2026-16149.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/os-info-meeb322k/MAL-2026-16149.json
- https://www.npmjs.com/package/os-info-meeb322k/v/1.0.0
- https://github.com/advisories/GHSA-5wwx-6p5f-p9vh

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.