easypanel-api-client@1.0.0

OSV Malicious Advisory

imported 1mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16073 confirms this npm version as malicious. The package ships an empty library body (index.js exports {}) and a preinstall lifecycle script that runs automatically on npm install. The preinstall script collects installer-side identifiers — hostname, username, current working directory, and the names of CI-related environment variables — base64url-encodes them, and transmits them via both a DNS lookup and an HTTP request to a subdomain of oob.lyomeri.com (e.g...

Advisory

MAL-2026-16073

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in easypanel-api-client (npm)

Details

The package ships an empty library body (index.js exports {}) and a preinstall lifecycle script that runs automatically on npm install. The preinstall script collects installer-side identifiers — hostname, username, current working directory, and the names of CI-related environment variables — base64url-encodes them, and transmits them via both a DNS lookup and an HTTP request to a subdomain of oob.lyomeri.com (e.g. easypanel-api-client.<encoded-chunk>.oob.lyomeri.com, with the HTTP variant POSTing to /npm/<encoded>). The package has no functional code beyond this beacon, matching the dependency-confusion / namespace-squat research-beacon shape targeting internal package names.

Decision reason

OpenSSF Malicious Packages via OSV confirms easypanel-api-client@1.0.0 as malicious (MAL-2026-16073): Malicious code in easypanel-api-client (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

easypanel-api-client@1.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code