{"id":"MAL-2026-15898","summary":"Malicious code in easypanel-ctl (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e9eb01006041231d7388c6aeb0c74288b35a8c72cf5b1e61c90e1e4f9d6d37c7)\nOn `npm install`, the preinstall lifecycle script collects installer host identity (hostname, username, cwd) and enumerates CI-related environment variable names, base64url-encodes the collected data, chunks it into DNS labels, and transmits it via both a DNS lookup and an HTTP GET to a hardcoded subdomain of oob.lyomeri.com (e.g. easypanel-ctl.\u003cencoded-chunk\u003e.oob.lyomeri.com, path /npm/\u003cencoded\u003e). The shipped module body is a stub (`module.exports = {}`), so the package has no legitimate runtime functionality; its only effect on install is the recon beacon. The destination is an out-of-band interaction domain unrelated to the easypanel.io publisher, and the encoding plus DNS-label chunking is a covert-channel exfiltration pattern. The name `easypanel-ctl` (with an empty stub body) is consistent with a dependency-confusion lure targeting installers of an internal or unrelated `easypanel` package.\n","modified":"2026-09-04T04:30:05.858262857Z","published":"2026-09-04T03:46:26Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-04T04:21:21.185722652Z","modified_time":"2026-09-04T03:46:26Z","sha256":"e9eb01006041231d7388c6aeb0c74288b35a8c72cf5b1e61c90e1e4f9d6d37c7","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-019457"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/easypanel-ctl/v/1.0.0"}],"affected":[{"package":{"name":"easypanel-ctl","ecosystem":"npm","purl":"pkg:npm/easypanel-ctl"},"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"2a488068fafa9202bb566b1a893a10fb193fd811","sha512_sri":"sha512-FZ0LjCd3NzVqrTEdDs6vq88ReL9+Gyxb1hyMco+nXUzn7qGB27gyvcc4q6sjVjDTtboVnTCCcFNQZdPJ/IFE+g=="},"filename":"easypanel-ctl-1.0.0.tgz"}],"evidence_files":[{"path":"preinstall.js","sha256":"acb0705a1355ae0935dc978ec0525d5ae3c51cdf7c7f631db8338896e0121aa6","tlsh":"181123b4d16092bd057162c0686a46a29277efd130e2c9c0683a66416fd26920bb38fe"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/easypanel-ctl/MAL-2026-15898.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}