OpenSSF/OSV advisory MAL-2026-14232 confirms this npm version as malicious. The package's postinstall script runs on `npm install` and issues an HTTPS POST to https://kvpq6u62.instances.poc.jchunt.top/chromeos-webdriver-cli carrying installer-identifying fields (os.hostname(), platform, arch, node version, package name, timestamp). The destination is a hardcoded non-first-party host reached without user consent or configuration. The subdomain shape (random-token under...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in chromeos-webdriver-cli (npm)
Details
The package's postinstall script runs on `npm install` and issues an HTTPS POST to https://kvpq6u62.instances.poc.jchunt.top/chromeos-webdriver-cli carrying installer-identifying fields (os.hostname(), platform, arch, node version, package name, timestamp). The destination is a hardcoded non-first-party host reached without user consent or configuration. The subdomain shape (random-token under instances.poc.jchunt.top) is consistent with a dependency-confusion / typo-squat canary beacon that discloses internal hostnames and environment metadata to a third party at install time.
Decision reason
OpenSSF Malicious Packages via OSV confirms chromeos-webdriver-cli@1.0.0 as malicious (MAL-2026-14232): Malicious code in chromeos-webdriver-cli (npm)