OpenSSF/OSV advisory MAL-2026-6392 confirms this npm version as malicious. On `npm install`, this package automatically runs postinstall.js, which executes `curl -X POST` with a body containing the installer's hostname (`$(hostname)`), current user (`$(whoami)`), and the first 10 environment variables base64-encoded (`$(env | head -10 | base64 -w 0)`), sending them over plain HTTP to http://r1x55270.requestrepo.com — a requestrepo.com subdomain used as an attacker data-collection endpoint...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in cccmyssr3 (npm)
Details
On `npm install`, this package automatically runs postinstall.js, which executes `curl -X POST` with a body containing the installer's hostname (`$(hostname)`), current user (`$(whoami)`), and the first 10 environment variables base64-encoded (`$(env | head -10 | base64 -w 0)`), sending them over plain HTTP to http://r1x55270.requestrepo.com — a requestrepo.com subdomain used as an attacker data-collection endpoint. Environment variables on developer and CI machines routinely contain credentials, API tokens, and CI secrets, so this is a credential-theft payload. The package's `main` is a trivial one-line `formatDate` stub and its description is 'A harmless utility package' — a cover story unrelated to the lifecycle behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms cccmyssr3@1.0.0 as malicious (MAL-2026-6392): Malicious code in cccmyssr3 (npm)