Live › package › MAL-2026-18519
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-11-03 07:48 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| service-roles-registry | npm | = 99.0.2 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
-= Per source details. Do not edit below this line.=-
[email protected] runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.
This page as .md · .json · in your agent: get_signal("MAL-2026-18519")