MAL-2026-16075

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/easypanel-hosting/MAL-2026-16075.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16075
Published
2026-09-09T05:33:15Z
Modified
2026-09-09T05:45:04Z
Summary
Malicious code in easypanel-hosting (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (db6a378b33bb2f33088ed90db4ac48e81368e30d5ef38578dca3b4345e9cb06b)

easypanel-hosting@1.0.0 ships a stub index.js (module.exports = {}) and an npm preinstall lifecycle script that collects the installer's hostname, username, current working directory, and CI-related environment variable names, base64url-encodes them, and sends them off-host via a DNS lookup and an HTTP request to a hardcoded out-of-band subdomain under lyomeri.com (e.g. easypanel-hosting.<token>.oob.lyomeri.com, with the encoded payload placed in the DNS label and in the HTTP path /npm/<encoded>). The exfiltration fires automatically on npm install before any user code runs. The empty main module and package name resembling a hosting-adjacent product are consistent with a dependency-confusion or reconnaissance probe; regardless of framing, installer identity metadata leaves the machine unconditionally to an author-controlled OOB collector.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019840",
            "import_time": "2026-09-09T05:40:09.116346755Z",
            "modified_time": "2026-09-09T05:33:15Z",
            "sha256": "db6a378b33bb2f33088ed90db4ac48e81368e30d5ef38578dca3b4345e9cb06b",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / easypanel-hosting

Package

Name
easypanel-hosting
View open source insights on deps.dev
Purl
pkg:npm/easypanel-hosting

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "sha256": "49433cbd5249046960dd19024fa773b621c073ce33b5c7d244710c0f0f424b09",
            "tlsh": "951127b0d160927d056161c0685f46969177dfd130e2cdc0683a66815fd26920bb3cfd"
        },
        {
            "path": "index.js",
            "sha256": "8222b8169ee86f25cdccd84d340340060ae3f0cff55e2ea9d344d7c332733b71"
        }
    ],
    "package_integrity": [
        {
            "filename": "easypanel-hosting-1.0.0.tgz",
            "hashes": {
                "sha1": "6a3ea4bf3b8fabe813503031c0c5d85278cdb0b6",
                "sha512_sri": "sha512-ZcIMJKNke5E7ZQR4JHkLFF+eiS0XFmSS6UN8/xITeJoyrbf30JCr1XV87eo+ie0YRAwZvIeZv0HgXOVQqrgk3Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/easypanel-hosting/MAL-2026-16075.json"