@usaa-grp-personal-profile/personal-profile-common

Details

**Severity:** Critical

**Affected versions:** `= 999.0.0`

## Source: amazon-inspector (de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a)
Package published to public npm under an internal-looking scope (@usaa-grp-personal-profile) at version 999.0.0, a shape consistent with dependency-confusion targeting an organization's internal registry. package.json declares preinstall and postinstall hooks that execute beacon.js on npm install. beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), hex-encodes them into DNS labels, and issues dns.lookup queries against a subdomain of oastify.com (Burp Collaborator out-of-band service), transmitting installer host, user, and working-directory identifiers to a third-party OAST endpoint on every install. The exfiltration fires automatically without user invocation and reaches an attacker-controllable Collaborator subdomain regardless of any research/PoC framing in the package metadata.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/@usaa-grp-personal-profile/personal-profile-common/MAL-2026-14370.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/@usaa-grp-personal-profile/personal-profile-common/MAL-2026-14370.json
- https://www.npmjs.com/package/@usaa-grp-personal-profile/personal-profile-common/v/999.0.0
- https://github.com/advisories/GHSA-rh37-fc24-hw7w

Compromised versions (1)

• = 999.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.