🛡️ MAL-2026-5445 — grateful-payments

Malicious code in grateful-payments (npm)

Source: amazon-inspector

On npm install, the package's postinstall script (src/canary.js) performs a DNS lookup and HTTPS GET to the hardcoded host 96e03fa6c292469a-172-245-86-254.serveousercontent.com at path /c. serveousercontent.com is an anonymous reverse-tunnel service, so the destination is operator-controlled and not tied to a verifiable publisher. Every installer's machine emits an unconsented outbound network call at install time, revealing source IP, DNS resolver path, and install timing to the tunnel operator — a classic install-fleet beaconing pattern used to confirm compromise reach. The package's own metadata describes itself as a HackerOne research canary with an empty main module, but the install-time network behavior is identical to a real install-time beacon and runs on anyone who installs this version.