🛡️ MAL-2026-12389 — github-app-sts-action

Malicious code in github-app-sts-action (npm)

Source: amazon-inspector

The package declares a preinstall lifecycle hook that runs index.js on npm install. index.js collects host identifiers and system files (os.hostname(), os.userInfo(), home directory, DNS servers, /etc/passwd, /etc/hosts, and package.json contents) and POSTs them via HTTPS to the hardcoded subdomain lncqub6t1loht8b887c8hvcjva13ptdi.oastify.com — a Burp Collaborator out-of-band interaction host used for reconnaissance. There is no advertised functional purpose in the package that would justify this data collection; the code path exists solely to transmit installer host and credential-adjacent file contents to an attacker-controlled endpoint.