🛡️ MAL-2026-12392 — hyper-kube-config

Malicious code in hyper-kube-config (npm)

Source: amazon-inspector

package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS server configuration, current working directory, and the contents of /etc/passwd and /etc/hosts, then POSTs this payload over HTTPS to the hardcoded subdomain x75h3spwmlqq7bzriw6gm6w8azgq4hs6.oastify.com (a Burp Collaborator out-of-band interaction host). Execution is automatic at install time with no consent prompt and no documented purpose. The behavior matches a dependency-confusion reconnaissance beacon that exfiltrates installer host identity and local system files to an attacker-controlled endpoint.