OpenSSF/OSV advisory MAL-2026-15895 confirms this npm version as malicious. The package's preinstall lifecycle script runs automatically on npm install and collects installer identity (os.hostname(), os.userInfo().username, process.cwd()) along with the names of CI-related environment variables. The collected data is JSON-serialized, base64url-encoded, chunked into DNS label form, and exfiltrated to a hardcoded third-party out-of-band collector at *.oob.lyomeri.com via both a dns.lookup()...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in easypanel-app (npm)
Details
The package's preinstall lifecycle script runs automatically on npm install and collects installer identity (os.hostname(), os.userInfo().username, process.cwd()) along with the names of CI-related environment variables. The collected data is JSON-serialized, base64url-encoded, chunked into DNS label form, and exfiltrated to a hardcoded third-party out-of-band collector at *.oob.lyomeri.com via both a dns.lookup() call and an HTTP GET to easypanel-app.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com. The name mimics the legitimate Easypanel project and the shape (preinstall + host/username/cwd + OOB DNS+HTTP beacon to a per-package subdomain) is a dependency-confusion reconnaissance beacon, disclosing installer identity and internal-package-name existence to a third party regardless of any 'benign canary' self-label.
Decision reason
OpenSSF Malicious Packages via OSV confirms easypanel-app@1.0.0 as malicious (MAL-2026-15895): Malicious code in easypanel-app (npm)