VYPR
← All malware advisories

npm · Malicious package advisory

Malware

tracker-cloudflare

MAL-2026-16140

Malicious code in tracker-cloudflare (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4)
The package's preinstall hook runs `node index.js`, which collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers, cwd) along with the contents of /etc/passwd and /etc/hosts, and POSTs the payload over HTTPS to the Burp Collaborator subdomain c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com. The package has empty description/author metadata and no legitimate functionality beyond this beacon. The exfiltration fires automatically on `npm install` before any consumer code runs.

Compromised versions (1)

  • 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.