OpenSSF/OSV advisory MAL-2026-12512 confirms this npm version as malicious. Package name `appsignal` shadows the legitimate `@appsignal/*` scope and is published at version `9999.0.0`, a version-number pattern used to outrank private/internal dependencies during resolution. A `preinstall` script runs automatically on `npm install` and issues an HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse`, carrying the installer's `os.hostname()`,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in appsignal (npm)
Details
Package name `appsignal` shadows the legitimate `@appsignal/*` scope and is published at version `9999.0.0`, a version-number pattern used to outrank private/internal dependencies during resolution. A `preinstall` script runs automatically on `npm install` and issues an HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse`, carrying the installer's `os.hostname()`, `os.userInfo().username`, `process.cwd()`, `npm_config_registry`, and CI repository-slug environment variables (`GITHUB_REPOSITORY`, `CI_PROJECT_PATH`, `BUILD_REPOSITORY_NAME`, `BITBUCKET_REPO_FULL_NAME`, `TRAVIS_REPO_SLUG`, `DRONE_REPO`, `BUILDKITE_PIPELINE_SLUG`, `CIRCLE_PROJECT_REPONAME`, `JOB_NAME`) as query parameters. The endpoint path `/depconfuse`, the bare-IP destination, the `9999.0.0` version, and the shadowing of an established scope indicate a dependency-confusion reconnaissance probe designed to identify internal build systems that resolve the public name over an intended private package.
Decision reason
OpenSSF Malicious Packages via OSV confirms appsignal@9999.0.0 as malicious (MAL-2026-12512): Malicious code in appsignal (npm)