MAL-2026-16335

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/keroeltopkk/MAL-2026-16335.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16335
Published
2026-09-21T03:32:08Z
Modified
2026-09-21T04:00:06Z
Summary
Malicious code in keroeltopkk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc)

Package keroeltopkk@99.99.99 ships only a manifest and a beacon script (server.js) and wires it into every npm lifecycle hook (preinstall/install/postinstall/prepare), so npm install auto-executes it. server.js reads os.hostname() and issues an HTTPS GET to https://eo8f3m3ho26a0nm.m.pipedream.net/${packageName}?h=${hostname}, a Pipedream request-bin acting as an attacker-controlled collector. The package version 99.99.99, empty description, absence of any real functionality, and duplicated Dependencies/dependencies keys are consistent with a dependency-confusion reconnaissance squat: the attacker publishes a high-version stub under a name that may match an internal/private package so that misconfigured resolvers pull the public stub and beacon the victim's hostname back on install.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020239",
            "import_time":  "2026-09-21T03:46:38.848717821Z",
            "modified_time":  "2026-09-21T03:32:08Z",
            "sha256":  "b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc",
            "source":  "amazon-inspector",
            "versions":  [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / keroeltopkk

Package

Name
keroeltopkk
View open source insights on deps.dev
Purl
pkg:npm/keroeltopkk

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "server.js",
            "sha256":  "5f260d84ddfa5ac81d1f76e1966f0d67a90e933cd49415d9dd0aa8a1a1bc0b24",
            "tlsh":  "03d0a7c703e5b7506ae14cc0e0170647675af13771a885b8a14c83c549e3ca105a35c0"
        },
        {
            "path":  "package.json",
            "sha256":  "ef3ab41c25285455bd198c9fc6b35c955926a144e73efcc2f47a6dc0b21ee602",
            "tlsh":  "83f03111dc445e6720bc15ac25d41603f724aeab839c1d0b35f3f1df2ea252e2156a2a"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "keroeltopkk-99.99.99.tgz",
            "hashes":  {
                "sha1":  "ace1b606be90231326d452016ef241a9d9039e58",
                "sha512_sri":  "sha512-o1Sc6ih7JtWsW1PG6tcDXXT46RlnL8We3PyrHuf7sMAGOuMBwlcBVR7zVZkK5Bg9T0nIOisN4HFCdDh7UQjzfA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/keroeltopkk/MAL-2026-16335.json"