🛡️ MAL-2026-6252 — zomato-logger

Malicious code in zomato-logger (npm)

Source: amazon-inspector

On npm install, the package's preinstall lifecycle script in package.json runs curl to POST the installer's hostname, current user (whoami), working directory, and the entire environment (base64-encoded env output) to http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/install/<base64-pkg> over plain HTTP. The destination is an Interactsh / oast.site out-of-band collaborator subdomain — infrastructure used to capture exfiltrated data from victim hosts. The package itself is a hollow stub (index.js exports only { name, version }), and the metadata (description: "Zomato logging library", repo URL git+https://github.com/zomato/zomato-logger.git) impersonates Zomato, consistent with a dependency-confusion attack targeting an org-internal package name. Any host that resolves and installs this package leaks every environment variable (including any CI secrets, tokens, and credentials present in the build environment) to the attacker.

Source: ossf-package-analysis

The OpenSSF Package Analysis project identified 'zomato-logger' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.
• The package executes one or more commands associated with malicious behavior.