🛡️ MAL-2026-12319 — core

Malicious code in @kite-js-tools/core (npm)

Source: amazon-inspector

package.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall hook performs an HTTPS GET to https://d9hugcagp7gsdcl9dvs0frxfmqc1o8u86.oast.pro/ with the installer's hostname and process PID embedded in the URL path. The postinstall hook performs a DNS resolution against postinstall.<hostname>.d9hugcagp7gsdcl9dvs0frxfmqc1o8u86.oast.pro, leaking the same host identifier via DNS to the same collaborator subdomain. The destination is a Project Discovery Interactsh (OAST) subdomain — out-of-band callback infrastructure typically used to confirm code execution and exfiltrate identifying data from compromised machines. Installer-side host identifiers leave the machine to an attacker-controlled endpoint on every install.