🛡️ MAL-2026-5863 — shared-lib

Malicious code in @ts-internal/shared-lib (npm)

Source: amazon-inspector

The package squats the internal-looking scope @ts-internal/shared-lib on the public npm registry and runs a network beacon both during install (preinstall and postinstall hooks invoke node lifecycle.js) and on module load (index.js calls require('./beacon').beacon('require')). beacon.js collects os.hostname(), os.userInfo().username, process.cwd(), os.platform(), and the package name/version, hex-encodes the blob, and transmits it via DNS lookup and HTTPS GET to d8oa6q03t3o2ksbjirogwxiwiyhp6e57o.oast.site (an interactsh OAST collector) and npm-dc-seek-1781572474.testingboxes.com. Any build that misresolves this name to the public registry will silently leak identifying host metadata to two third-party endpoints. The README self-describes the package as a dependency-confusion proof-of-concept, but installers cannot consent and cannot verify researcher authorization; the squat-plus-beacon mechanism is the attack regardless of stated intent.