test89078-auth

GHSA-x9mp-cqw3-368c

Malicious code in test89078-auth (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.99.99`

## Source: amazon-inspector (c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573)
The package's preinstall script (scripts.preinstall = 'node index.js') runs automatically on npm install and collects os.userInfo().username and os.hostname(), then issues a dns.lookup against a subdomain of 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site with the username and hostname embedded in the queried label. This is a DNS-based exfiltration beacon: installing the package transmits installer host identifiers to a non-first-party canary domain over DNS resolution at install time. The version number 99.99.99 and package name shape are consistent with a dependency-confusion lure targeting an internal package name.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/3993d521acd1486d7f417803e3ab35e8ab0de7a0/osv/malicious/npm/test89078-auth/MAL-2026-16271.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/3993d521acd1486d7f417803e3ab35e8ab0de7a0/osv/malicious/npm/test89078-auth/MAL-2026-16271.json
- https://www.npmjs.com/package/test89078-auth/v/99.99.99
- https://github.com/advisories/GHSA-x9mp-cqw3-368c

Compromised versions (1)

= 99.99.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.