OpenSSF/OSV advisory MAL-2026-15896 confirms this npm version as malicious. The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable names, base64url-encodes them, and transmits them to the hardcoded out-of-band host easypanel-client.<subdomain>.oob.lyomeri.com via both a DNS lookup and an HTTP GET request. The shipped index.js is empty (module.exports = {}), so the only effect of installing this package...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in easypanel-client (npm)
Details
The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable names, base64url-encodes them, and transmits them to the hardcoded out-of-band host easypanel-client.<subdomain>.oob.lyomeri.com via both a DNS lookup and an HTTP GET request. The shipped index.js is empty (module.exports = {}), so the only effect of installing this package is the install-time beacon. The package name and structure are consistent with a dependency-confusion probe targeting internal easypanel-* names.
Decision reason
OpenSSF Malicious Packages via OSV confirms easypanel-client@1.0.0 as malicious (MAL-2026-15896): Malicious code in easypanel-client (npm)