OpenSSF/OSV advisory MAL-2026-5894 confirms this npm version as malicious. Package name mimics Vercel's official `create-*` initializer convention (e.g. `create-next-app`), targeting developers who mistype or guess the initializer name and invoke `npx create-vercel-integration`. The bin script (`bin/run.js`) hardcodes a callback URL `https://deepbounty.dd06-dev.fr/cb/f7506d76-f300-4c91-a105-41c07ad317fc` and, on invocation, reads the `INIT_CWD` environment variable, extracts its basename,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in create-vercel-integration (npm)
Details
Package name mimics Vercel's official `create-*` initializer convention (e.g. `create-next-app`), targeting developers who mistype or guess the initializer name and invoke `npx create-vercel-integration`. The bin script (`bin/run.js`) hardcodes a callback URL `https://deepbounty.dd06-dev.fr/cb/f7506d76-f300-4c91-a105-41c07ad317fc` and, on invocation, reads the `INIT_CWD` environment variable, extracts its basename, and POSTs `{pkg, timestamp, transport, project}` to that author-controlled endpoint. The package self-describes as a 'Bug Bounty PoC,' but it is published on the public npm registry under a name shaped like an official Vercel scaffold and silently leaks the installer's project directory name to a third party with no disclosure or opt-out. The package provides no legitimate Vercel-integration scaffolding functionality; the bin's only effect is the beacon.
Decision reason
OSV/OpenSSF confirms create-vercel-integration@1.0.0 as malicious package MAL-2026-5894. Malicious code in create-vercel-integration (npm)