// Data staging
pattern: oast-callback-domain
Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.
10 packages flagged with this pattern (11 total publish events, collapsed by publisher+name). Newest first.
Hijack by Yusif Kerimov
→ Sends to suspicious destination(s): ulehcosybxwttseibbych07wphlyoxhfr.oast.fun.
Interface utility for performance monitoring and diagnostic reporting.
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
Security research - authorized dependency confusion testing
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
Security research canary — vercel
→ No suspicious destination, no remote-exec shape — 1 other host(s).
Security research canary — vercel
→ No suspicious destination, no remote-exec shape — 1 other host(s).
Security research canary — shopify
→ No suspicious destination, no remote-exec shape — 1 other host(s).
Security research - authorized dependency confusion testing
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
Security research canary — NASA VDP
→ No suspicious destination, no remote-exec shape — 1 other host(s).
Security research canary — NASA VDP
→ No suspicious destination, no remote-exec shape — 4 known-vendor host(s), 1 other host(s).
Pluxee account database API client
→ No suspicious destination, no remote-exec shape — 1 other host(s).
