🛡️ MAL-2024-1783 — auth0.net

Malicious code in auth0.net (npm)

Source: amazon-inspector

On npm install, package.json's preinstall (and preupdate/test) hook runs nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun. The destination oast.fun is the Project Discovery interactsh out-of-band callback service used to confirm code execution on victim hosts via a unique DNS subdomain. Firing automatically on install leaks the installer's existence and the corporate DNS resolver's egress IP to an attacker-controlled nameserver, with the unique subdomain serving as a per-victim correlation token. The package itself is hollow — index.js is empty, description is the placeholder 'Internal package', and author is 'Team' — and the package name auth0.net impersonates the Auth0 brand, consistent with a dependency-confusion attempt against an internal Auth0/.NET package name. The DNS beacon is the recon stage of that attack: the operator learns which organizations have misconfigured their registry resolution to pull this public package instead of an internal one, enabling targeted follow-on compromise.