OpenSSF/OSV advisory MAL-2026-4427 confirms this npm version as malicious. On `npm install`, both `preinstall` and `postinstall` lifecycle hooks execute `postinstall.js`, which collects host identifiers (hostname, platform, arch, OS username, cwd, Node version) and the full sorted list of `process.env` key names, then POSTs the JSON payload to a hardcoded `https://webhook.site/d81181e1-e40b-478f-a0b4-f18069f9f677` collector. The package name `@rocketreach/rr-components` at version...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @rocketreach/rr-components (npm)
Details
On `npm install`, both `preinstall` and `postinstall` lifecycle hooks execute `postinstall.js`, which collects host identifiers (hostname, platform, arch, OS username, cwd, Node version) and the full sorted list of `process.env` key names, then POSTs the JSON payload to a hardcoded `https://webhook.site/d81181e1-e40b-478f-a0b4-f18069f9f677` collector. The package name `@rocketreach/rr-components` at version `9999.0.0` together with the self-identifying `proof: "dependency-confusion-poc"` field in the payload is the canonical dependency-confusion shape: publishing a high-version package under a target organization's private scope to public npm so that any misconfigured internal build resolves it. Even environment variable NAMES (not values) leak CI secret-naming schemes useful for follow-on attacks. Fires automatically on install with no user interaction.
Decision reason
OpenSSF Malicious Packages via OSV confirms @rocketreach/rr-components@9999.0.0 as malicious (MAL-2026-4427): Malicious code in @rocketreach/rr-components (npm)