@s4yhiitestpoc/scan-https-d

GHSA-845p-jq49-x946

Malicious code in @s4yhiitestpoc/scan-https-d (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea)
On `npm install`, postinstall.js collects installer host identity — os.hostname(), os.userInfo().username, home directory, cwd, non-internal network interface addresses, DNS servers, and platform/arch/release — and POSTs it as JSON over HTTPS to the hardcoded endpoint https://collector.oob.s4yhii.com/_npm-poc/beacon, with a secondary DNS lookup against *.oob.s4yhii.com as an out-of-band execution signal. The package's scope (`@s4yhiitestpoc/*`) and metadata self-describe this as a dependency-confusion proof-of-concept targeting internal namespaces that resolve to the public registry; the self-labeling does not change the fact that installer host identifiers leave the installer's machine on install to a hardcoded third-party domain the installer did not opt into.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/@s4yhiitestpoc/scan-https-d/MAL-2026-17766.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/@s4yhiitestpoc/scan-https-d/MAL-2026-17766.json
- https://www.npmjs.com/package/@s4yhiitestpoc/scan-https-d/v/1.0.0
- https://github.com/advisories/GHSA-845p-jq49-x946

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.