🛡️ MAL-2026-12386 — fundraiserservpp

Malicious code in fundraiserservpp (npm)

Source: amazon-inspector

[email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machine — os.hostname(), os.platform(), os.arch(), the user home directory path, and configured DNS servers — and issues an HTTPS POST to a hardcoded Burp Collaborator subdomain (mrh99ucv1u3kyeba1020ae2t7kdc12pr.oastify.com/hit) with that data as a JSON body. The beacon fires automatically at install time with no user interaction. The destination is an attacker-controlled out-of-band interaction endpoint typical of dependency-confusion reconnaissance, confirming to the operator that the package name was successfully resolved and installed inside a target build environment.