OSV ID
MAL-2026-11518
Ecosystem
npm
Summary
Package name 'exnesss' typosquats 'exness'. The package.json declares scripts.postinstall: 'node./postinstall.js', and postinstall.js issues an HTTPS GET to a hardcoded Burp Collaborator subdomain (hteimcuxkeb6pacscuexz4d9y04rshg6.oastify.com) on every install. This fires automatically on npm install, contacting an out-of-band interaction host that reveals the installer's network/DNS metadata to the operator of that Collaborator instance. The package provides no advertised functionality to the installer beyond the beacon.
Source: amazon-inspector (184796b4aafee8400786643e9f43338886de2166171c62879cfd4c023655b487)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.