MAL-2026-16335
Malicious code in keroeltopkk (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc) Package keroeltopkk@99.99.99 ships only a manifest and a beacon script (server.js) and wires it into every npm lifecycle hook (preinstall/install/postinstall/prepare), so `npm install` auto-executes it. server.js reads os.hostname() and issues an HTTPS GET to https://eo8f3m3ho26a0nm.m.pipedream.net/${packageName}?h=${hostname}, a Pipedream request-bin acting as an attacker-controlled collector. The package version 99.99.99, empty description, absence of any real functionality, and duplicated Dependencies/dependencies keys are consistent with a dependency-confusion reconnaissance squat: the attacker publishes a high-version stub under a name that may match an internal/private package so that misconfigured resolvers pull the public stub and beacon the victim's hostname back on install.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for keroeltopkk (npm). Pin to a known-safe version or switch to an alternative.