MAL-2026-16336

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/keroeltopkkk/MAL-2026-16336.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16336
Published
2026-09-21T03:32:25Z
Modified
2026-09-21T04:00:05Z
Summary
Malicious code in keroeltopkkk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2758c1a2619db534fdc8e2981e051769b20641492d12ff984e333446e0c734e3)

The package ships a single server.js that is wired into every npm lifecycle hook (preinstall, install, postinstall, prepare, prepublish, preprepare, postprepare). On npm install the script reads os.hostname() and issues an HTTPS GET to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/, sending the installer's hostname and the package name as query parameters to an author-controlled pipedream.net webhook collector. The package has no other functionality: package.json carries an empty description, a placeholder ISC license, a name resembling a token, and version 99.99.99 — the canonical shape used to probe whether a private/internal package name resolves against the public npm registry (dependency confusion). The exfiltrated hostname discloses internal build-host or developer-machine identifiers to the beacon operator.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020241",
            "import_time":  "2026-09-21T03:46:39.091647703Z",
            "modified_time":  "2026-09-21T03:32:25Z",
            "sha256":  "2758c1a2619db534fdc8e2981e051769b20641492d12ff984e333446e0c734e3",
            "source":  "amazon-inspector",
            "versions":  [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / keroeltopkkk

Package

Name
keroeltopkkk
View open source insights on deps.dev
Purl
pkg:npm/keroeltopkkk

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "server.js",
            "sha256":  "478ad8ce9416e23804ad130182994cddc3b9aac32372cc5698ede55658058cb4",
            "tlsh":  "efd0a7c703e5b7506ae14cc0e0160647675af13771b885b8a14c978549e28a105a35c0"
        },
        {
            "path":  "package.json",
            "sha256":  "b8675259d129304b9574759b5cb6e3ada8617809eb57e8c8fadd27fb7d405bfd",
            "tlsh":  "d6f06522dc845f2b34f88ebd24950245b3284b6f232c080bb2bb055f0ff351e6656b15"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "keroeltopkkk-99.99.99.tgz",
            "hashes":  {
                "sha1":  "4249d958860ea4f48d43515afafebb4b1e8d7470",
                "sha512_sri":  "sha512-YMzJ4XpwXIltJtyjJlWmZ5KWJ4PbYwdAHv1e8++3seGq/CcwRcT+auR6bvIJcHv+QcqQE0ONt9lU9Ds9oFdxGQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/keroeltopkkk/MAL-2026-16336.json"