OpenSSF/OSV advisory MAL-2026-15922 confirms this npm version as malicious. claude-channel-discord@9.9.9 is a dependency-confusion probe. package.json declares preinstall and postinstall hooks (`node index.js --save-prod`) and a main entry that both execute index.js, which reads os.hostname() and issues a GET to https://eo8f3m3ho26a0nm.m.pipedream.net/claude-channel-discord?h=${hostname}. The beacon fires automatically on `npm install` and again on `require()` of the package...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in claude-channel-discord (npm)
Details
claude-channel-discord@9.9.9 is a dependency-confusion probe. package.json declares preinstall and postinstall hooks (`node index.js --save-prod`) and a main entry that both execute index.js, which reads os.hostname() and issues a GET to https://eo8f3m3ho26a0nm.m.pipedream.net/claude-channel-discord?h=${hostname}. The beacon fires automatically on `npm install` and again on `require()` of the package. The package has an empty description, an implausibly high 9.9.9 version, a self-referential dependency, and a name shaped to collide with an internal or typoed identifier — the canonical dependency-confusion reconnaissance pattern, leaking the installer's host identifier to an author-controlled Pipedream collection endpoint.
Decision reason
OpenSSF Malicious Packages via OSV confirms claude-channel-discord@9.9.9 as malicious (MAL-2026-15922): Malicious code in claude-channel-discord (npm)