{"id":"MAL-2026-16297","summary":"Malicious code in keroeltop (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199)\nkeroeltop@99.99.99 is a lure package whose index.js runs on every npm lifecycle phase (preinstall/install/postinstall/prepare) and issues an HTTP request to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/\u003cpackages\u003e?h=\u003chostname\u003e, transmitting the installer's os.hostname() to an attacker-controlled Pipedream webhook. The version number 99.99.99 is the canonical dependency-confusion resolution-winning shape used to override an internal package name. The package additionally declares a dependency on `requests@^0.3.0` (an npm name resembling `request`) and requires it at the top of index.js, causing whatever bytes resolve for that name to be fetched and loaded transitively at install time. No legitimate functionality is present.\n\n## Source: ossf-package-analysis (89aae084914d96e7e7620a79371083c4e1bb4a838fac1633aff257c5a380eab8)\nThe OpenSSF Package Analysis project identified 'keroeltop' @ 99.99.99 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-09-21T04:00:05.882431134Z","published":"2026-09-18T23:41:11Z","database_specific":{"malicious-packages-origins":[{"versions":["99.99.99"],"import_time":"2026-09-19T00:46:16.668706167Z","modified_time":"2026-09-18T23:41:11Z","sha256":"89aae084914d96e7e7620a79371083c4e1bb4a838fac1633aff257c5a380eab8","source":"ossf-package-analysis"},{"import_time":"2026-09-21T03:46:38.993861039Z","modified_time":"2026-09-21T03:32:17Z","sha256":"0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199","source":"amazon-inspector","versions":["99.99.99"],"id":"IN-MAL-2026-020240"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/keroeltop/v/99.99.99"}],"affected":[{"package":{"name":"keroeltop","ecosystem":"npm","purl":"pkg:npm/keroeltop"},"versions":["99.99.99"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-jxB88MQo9UyyL3mlpJUeCaXaw9CrbJFOatFoAPtK4wrDrEmurXLx6V3Ud49hlQwRrCAca/M+Gb1Pro4LuEUTlw==","sha1":"2c9025652cb8a84fc3be7b9733e40e51380af90d"},"filename":"keroeltop-99.99.99.tgz"}],"evidence_files":[{"sha256":"29c76f4e298a29804ee501499e4bec494249577ef5565ffab49e39b4ac7f8ebb","tlsh":"3dd0a7c703d9b3506ae14cc0e0160607774af13771a845b8a14c938549e28a105a35c0","path":"index.js"},{"sha256":"488b99bb47a15dfe24f680d3216cf9593ee4afb1046864ea7a813372b42a09b8","tlsh":"6df04971dc505e5320bc15e4756a2d07f1521f6b439c1d4b34f3f1dd76e1522809e72a","path":"package.json"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/keroeltop/MAL-2026-16297.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}