MAL-2026-15898

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e9eb01006041231d7388c6aeb0c74288b35a8c72cf5b1e61c90e1e4f9d6d37c7) On `npm install`, the preinstall lifecycle script collects installer host identity (hostname, username, cwd) and enumerates CI-related environment variable names, base64url-encodes the collected data, chunks it into DNS labels, and transmits it via both a DNS lookup and an HTTP GET to a hardcoded subdomain of oob.lyomeri.com (e.g. easypanel-ctl.<encoded-chunk>.oob.lyomeri.com, path /npm/<encoded>). The shipped module body is a stub (`module.exports = {}`), so the package has no legitimate runtime functionality; its only effect on install is the recon beacon. The destination is an out-of-band interaction domain unrelated to the easypanel.io publisher, and the encoding plus DNS-label chunking is a covert-channel exfiltration pattern. The name `easypanel-ctl` (with an empty stub body) is consistent with a dependency-confusion lure targeting installers of an internal or unrelated `easypanel` package.