🛡️ MAL-2026-13444 — dpdgroup-css

Malicious code in dpdgroup-css (npm)

Source: amazon-inspector

package.json declares both preinstall and postinstall lifecycle hooks that run node setup.js on every npm install. setup.js reads the installer's machine hostname via os.hostname() and issues an HTTP GET to a hardcoded bare-IP callback at http://89.116.25.133:4444/dpdgroup-css/<hostname>, with the hostname also carried in an X-PoC-Host header. The package name dpdgroup-css resembles an internal scope for the DPDgroup courier organization, consistent with a dependency-confusion attack: a private build that resolves this public version instead of an intended internal package auto-runs the beacon and discloses the internal build-host identifier to an external, non-first-party bare-IP endpoint. No legitimate library functionality is present.