OpenSSF/OSV advisory MAL-2026-12315 confirms this npm version as malicious. On npm install, the package's postinstall script (dist/recon.js) collects installer-side host reconnaissance — hostname, username, SUDO_USER, home directory, cwd, network interfaces including internal IPs, DNS domain via dnsdomainname, and npm lifecycle context — and enumerates process.env, filtering the key names against a regex targeting AWS, GCP, AZURE, NPM, NODE_AUTH, DOCKER, KUBE, VAULT, TOKEN, SECRET, KEY,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @cryptosrvc/no-brainer-sdk (npm)
Details
On npm install, the package's postinstall script (dist/recon.js) collects installer-side host reconnaissance — hostname, username, SUDO_USER, home directory, cwd, network interfaces including internal IPs, DNS domain via dnsdomainname, and npm lifecycle context — and enumerates process.env, filtering the key names against a regex targeting AWS, GCP, AZURE, NPM, NODE_AUTH, DOCKER, KUBE, VAULT, TOKEN, SECRET, KEY, PASS, CRED, GITHUB, GITLAB, and SSH. Both the full env-name list and the credential-shaped subset are serialized and POSTed as JSON over plain HTTP to hardcoded bare IP 138.68.108.20:80/cb, with a `npm-install-telemetry/1.0` User-Agent and an inline comment framing the payload as 'NON-SENSITIVE telemetry only' despite including sudo_user, internal network layout, and credential env-var name inventory. Behavior fires automatically as a postinstall lifecycle hook.
Decision reason
OpenSSF Malicious Packages via OSV confirms @cryptosrvc/no-brainer-sdk@1.0.18 as malicious (MAL-2026-12315): Malicious code in @cryptosrvc/no-brainer-sdk (npm)