@prime0/pcomatch@1.0.0

OSV Malicious Advisory

imported 24d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16206 confirms this npm version as malicious. index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On `npm install`, the postinstall hook collects host identifiers (hostname, username, platform, arch, cwd, node version, pid, all non-internal IP addresses, uptime, package name) and POSTs them as JSON to /b...

Advisory

MAL-2026-16206

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @prime0/pcomatch (npm)

Details

index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On `npm install`, the postinstall hook collects host identifiers (hostname, username, platform, arch, cwd, node version, pid, all non-internal IP addresses, uptime, package name) and POSTs them as JSON to /b. On `require()` of the package main, the module beacons the same host, then polls /c every 30 seconds for JSON commands and executes the `c` field via child_process.exec, POSTing stdout/stderr back to /r. A source comment self-identifies the module as a stealth typosquat agent, while package.json advertises only a generic "small utility" description.

Decision reason

OpenSSF Malicious Packages via OSV confirms @prime0/pcomatch@1.0.0 as malicious (MAL-2026-16206): Malicious code in @prime0/pcomatch (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

@prime0/pcomatch@1.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code