🛡️ MAL-2026-12368 — electrode-ota-ui-app

Malicious code in electrode-ota-ui-app (npm)

Source: amazon-inspector

Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private registry. package.json declares both main: index.js and scripts.postinstall: node index.js, so on npm install and on any require() the package unconditionally runs collectAndSend() in index.js. That function gathers host identifiers via os.hostname(), os.userInfo(), os.platform(), and os.release(), resolves the installer's public IP via ipify and geo/ISP data via ipapi.co, and POSTs a JSON payload to the hardcoded Burp Collaborator subdomain https://itfv50wbocctx0j32fyfq8z7uy0ptdn1c.oastify.com/callback, controlled by the package author. README self-labels as a dependency-confusion PoC, but the callback is live and any installer whose resolver picks this public package over the intended internal one is compromised.