{"id":"MAL-2026-16335","summary":"Malicious code in keroeltopkk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc)\nPackage keroeltopkk@99.99.99 ships only a manifest and a beacon script (server.js) and wires it into every npm lifecycle hook (preinstall/install/postinstall/prepare), so `npm install` auto-executes it. server.js reads os.hostname() and issues an HTTPS GET to https://eo8f3m3ho26a0nm.m.pipedream.net/${packageName}?h=${hostname}, a Pipedream request-bin acting as an attacker-controlled collector. The package version 99.99.99, empty description, absence of any real functionality, and duplicated Dependencies/dependencies keys are consistent with a dependency-confusion reconnaissance squat: the attacker publishes a high-version stub under a name that may match an internal/private package so that misconfigured resolvers pull the public stub and beacon the victim's hostname back on install.\n","modified":"2026-09-21T04:00:06.886171463Z","published":"2026-09-21T03:32:08Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-21T03:32:08Z","sha256":"b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc","source":"amazon-inspector","versions":["99.99.99"],"id":"IN-MAL-2026-020239","import_time":"2026-09-21T03:46:38.848717821Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/keroeltopkk/v/99.99.99"}],"affected":[{"package":{"name":"keroeltopkk","ecosystem":"npm","purl":"pkg:npm/keroeltopkk"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/keroeltopkk/MAL-2026-16335.json","indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-o1Sc6ih7JtWsW1PG6tcDXXT46RlnL8We3PyrHuf7sMAGOuMBwlcBVR7zVZkK5Bg9T0nIOisN4HFCdDh7UQjzfA==","sha1":"ace1b606be90231326d452016ef241a9d9039e58"},"filename":"keroeltopkk-99.99.99.tgz"}],"evidence_files":[{"sha256":"5f260d84ddfa5ac81d1f76e1966f0d67a90e933cd49415d9dd0aa8a1a1bc0b24","tlsh":"03d0a7c703e5b7506ae14cc0e0170647675af13771a885b8a14c83c549e3ca105a35c0","path":"server.js"},{"sha256":"ef3ab41c25285455bd198c9fc6b35c955926a144e73efcc2f47a6dc0b21ee602","tlsh":"83f03111dc445e6720bc15ac25d41603f724aeab839c1d0b35f3f1df2ea252e2156a2a","path":"package.json"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}