R17D-SEC-RESEARCH-MARKER · MAL-2026-19227 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Unknown from the sources.
Unknown from the sources.
-= Per source details. Do not edit below this line.=-
On npm install, the package's postinstall script (collect.js) runs shell listings of the home directory and current working directory, probes for the presence of installer credential/config files (~/.npmrc, ~/.gitconfig, ~/.config/gh, ~/.novus), enumerates all process.env variable names, and POSTs the collected JSON to a hardcoded anonymous inspection endpoint at webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61. The host reconnaissance includes the output of whoami, OS/kernel info, home-directory listing, dotfile presence inventory, and the full environment variable name list — a dataset that reveals CI provider, cloud credential presence, and secret-store usage, suitable for follow-on credential targeting. The script's self-label as a 'security research POC collecting metadata only' does not change the behavior: the installer did not opt in, the destination is an anonymous third-party collector, and the presence inventory of credential paths is itself exfiltration.
This page as ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.