MAL-2026-19226: Malicious code in quickgreet (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (430a8463ba4e5ea6b5dcb99d7410212773157b1c609d78b5a43bdf0cf9cd6c1b) package.json declares a postinstall lifecycle script that runs an inline Node command reading os.hostname() and issuing an HTTP GET to <hostname>.<subdomain>.oast.fun. The oast.fun service is an out-of-band interaction / callback collector used to confirm code execution and enumerate reachable installer environments; the hostname is embedded in the DNS label so it is captured by the operator's interactsh listener. The script performs no build, native-compile, or install task — its sole effect is to exfiltrate an installer identifier to an attacker-controlled OOB endpoint on every npm install.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to the callback?
Any installer environment where npm installs quickgreet can expose its hostname. The postinstall script sends an HTTP GET to an attacker-controlled oast.fun endpoint with the hostname embedded in the subdomain.
What must an attacker do to trigger the behavior?
The package must be installed through npm so that its postinstall lifecycle script runs. The described script does not require further user interaction after installation.
How can I determine whether an installation contacted the operator?
Inspect the package's package.json for a postinstall script that reads os.hostname() and makes a request to an oast.fun subdomain. Network or DNS telemetry may also show requests whose hostname includes the installing system's hostname and ends in oast.fun.
What can be done if the package has not yet been installed?
Do not install quickgreet, because the described postinstall script's sole stated effect is sending an installer identifier to the external callback endpoint.