MAL-2026-12431
Malicious code in rpc-endpoint-rotator (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (7eda47a0d1da23b08d63a5fa4339234b9a19bc7aedf7b74d060731b24841be2a) index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname, username, and home directory. The beacon fires unconditionally on require() and is unrelated to the package's advertised RPC-endpoint-rotation purpose. Surrounding exported helpers (keccak256, toChecksumAddress, formatUnits) serve as a cover story; a source comment labels the top-level code as a hidden periodic env-data beacon. Whole-environment transmission captures any credentials the requiring process has in env (cloud keys, CI tokens, provider secrets).
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for rpc-endpoint-rotator (npm). Pin to a known-safe version or switch to an alternative.