🛡️ MAL-2026-5416 — routes

Malicious code in @klapp-otp/routes (npm)

Source: amazon-inspector

On npm install, this package auto-executes index.js via the preinstall lifecycle hook. The script collects os.hostname(), os.userInfo(), __dirname, process.cwd(), and the package name, then exfiltrates them through two channels: (1) a hex-encoded DNS A-record query to <encoded>.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live (an interactsh out-of-band collector), and (2) an HTTP POST of the same JSON payload to http://172.201.213.59:9090/c. Both channels fire unconditionally on install, leaking installer identity to attacker-controlled infrastructure. The package metadata reinforces the dependency-confusion / namespace-squat shape: scope @klapp-otp with version 99.0.0 and the description string security research, paired with no legitimate functionality in the tarball.