MAL-2026-16297

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/keroeltop/MAL-2026-16297.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16297
Published
2026-09-18T23:41:11Z
Modified
2026-09-21T04:00:05Z
Summary
Malicious code in keroeltop (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199)

keroeltop@99.99.99 is a lure package whose index.js runs on every npm lifecycle phase (preinstall/install/postinstall/prepare) and issues an HTTP request to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/?h=, transmitting the installer's os.hostname() to an attacker-controlled Pipedream webhook. The version number 99.99.99 is the canonical dependency-confusion resolution-winning shape used to override an internal package name. The package additionally declares a dependency on requests@^0.3.0 (an npm name resembling request) and requires it at the top of index.js, causing whatever bytes resolve for that name to be fetched and loaded transitively at install time. No legitimate functionality is present.

Source: ossf-package-analysis (89aae084914d96e7e7620a79371083c4e1bb4a838fac1633aff257c5a380eab8)

The OpenSSF Package Analysis project identified 'keroeltop' @ 99.99.99 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-09-19T00:46:16.668706167Z",
            "modified_time":  "2026-09-18T23:41:11Z",
            "sha256":  "89aae084914d96e7e7620a79371083c4e1bb4a838fac1633aff257c5a380eab8",
            "source":  "ossf-package-analysis",
            "versions":  [
                "99.99.99"
            ]
        },
        {
            "id":  "IN-MAL-2026-020240",
            "import_time":  "2026-09-21T03:46:38.993861039Z",
            "modified_time":  "2026-09-21T03:32:17Z",
            "sha256":  "0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199",
            "source":  "amazon-inspector",
            "versions":  [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / keroeltop

Package

Name
keroeltop
View open source insights on deps.dev
Purl
pkg:npm/keroeltop

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "29c76f4e298a29804ee501499e4bec494249577ef5565ffab49e39b4ac7f8ebb",
            "tlsh":  "3dd0a7c703d9b3506ae14cc0e0160607774af13771a845b8a14c938549e28a105a35c0"
        },
        {
            "path":  "package.json",
            "sha256":  "488b99bb47a15dfe24f680d3216cf9593ee4afb1046864ea7a813372b42a09b8",
            "tlsh":  "6df04971dc505e5320bc15e4756a2d07f1521f6b439c1d4b34f3f1dd76e1522809e72a"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "keroeltop-99.99.99.tgz",
            "hashes":  {
                "sha1":  "2c9025652cb8a84fc3be7b9733e40e51380af90d",
                "sha512_sri":  "sha512-jxB88MQo9UyyL3mlpJUeCaXaw9CrbJFOatFoAPtK4wrDrEmurXLx6V3Ud49hlQwRrCAca/M+Gb1Pro4LuEUTlw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/keroeltop/MAL-2026-16297.json"