Malicious code in @dransay/db (npm)

Source: amazon-inspector dc3d55a63787b5f45312d0b8433f6e782b2a6b28e89ef6377e24e5d26c757a61 On npm install, the package's preinstall hook executes beacon.js, which performs a DNS lookup and HTTPS GET to a hardcoded interactsh OAST subdomain under oast.site, embedding the package name in the path. T...

Malicious code in @dransay/db (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name ...

MAL-2026-17695 Malicious code in @dransay/db (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name ...

Malicious Package

Overview @dransay/db is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...