Malicious Packages on npm, PyPI, and RubyGems Weaponize OAST Techniques for Data Exfiltration and Recon

Over the last year, researchers at Socket observed and identified malicious packages leveraging Out-of-Band Application Security Testing (OAST) services such as oastify[.]com and oast[.]fun to exfiltrate sensitive data to attacker-controlled servers.