OpenSSF/OSV advisory MAL-2026-14227 confirms this npm version as malicious. This npm package uses the name `bazelisk`, colliding with Google's bazelbuild/bazelisk project (referenced in the tarball's source.txt), and self-labels as a 'Security research canary'. Its postinstall script collects the installer's hostname, platform, arch, Node version, package name, and npm lifecycle event and POSTs that JSON payload to https://grqx3qve.instances.poc.jchunt.top/bazelisk at `npm install` time...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bazelisk (npm)
Details
This npm package uses the name `bazelisk`, colliding with Google's bazelbuild/bazelisk project (referenced in the tarball's source.txt), and self-labels as a 'Security research canary'. Its postinstall script collects the installer's hostname, platform, arch, Node version, package name, and npm lifecycle event and POSTs that JSON payload to https://grqx3qve.instances.poc.jchunt.top/bazelisk at `npm install` time. The destination host is unrelated to the real bazelisk publisher. Installer host identifiers and environment fingerprint leave the machine automatically on install, matching a dependency-confusion beacon pattern.
Decision reason
OpenSSF Malicious Packages via OSV confirms bazelisk@1.0.0 as malicious (MAL-2026-14227): Malicious code in bazelisk (npm)