OpenSSF/OSV advisory MAL-2026-12325 confirms this npm version as malicious. On require(), index.js unconditionally calls a telemetry() function at module top level that collects host reconnaissance (hostname, username, __dirname, cwd, OS/arch, Node version) and the list of environment variable names, base64-encodes the payload, and POSTs it over plain HTTP to the hardcoded host attacker.cl. The destination is not associated with the package's stated publisher (@nextco/utils / nextco.me) and...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @nextco/utils (npm)
Details
On require(), index.js unconditionally calls a telemetry() function at module top level that collects host reconnaissance (hostname, username, __dirname, cwd, OS/arch, Node version) and the list of environment variable names, base64-encodes the payload, and POSTs it over plain HTTP to the hardcoded host attacker.cl. The destination is not associated with the package's stated publisher (@nextco/utils / nextco.me) and the caller has no opt-out. The behavior fires simply by loading the module, giving an attacker installer host identifiers and an env-var name inventory usable to target follow-on credential theft.
Decision reason
OpenSSF Malicious Packages via OSV confirms @nextco/utils@5.0.0 as malicious (MAL-2026-12325): Malicious code in @nextco/utils (npm)