OpenSSF/OSV advisory MAL-2026-15897 confirms this npm version as malicious. easypanel-core ships an inert `module.exports = {}` main and places all functionality in a preinstall lifecycle script. On `npm install`, preinstall.js collects os.hostname(), os.userInfo().username, process.cwd(), and the names of CI-related environment variables, base64url-encodes them, and transmits the data to `*.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com` via both a DNS subdomain lookup and an HTTP GET...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in easypanel-core (npm)
Details
easypanel-core ships an inert `module.exports = {}` main and places all functionality in a preinstall lifecycle script. On `npm install`, preinstall.js collects os.hostname(), os.userInfo().username, process.cwd(), and the names of CI-related environment variables, base64url-encodes them, and transmits the data to `*.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com` via both a DNS subdomain lookup and an HTTP GET to `/npm/<encoded>`. The package name mimics the easypanel project and the description advertises a 'client library', while the shipped library exports nothing and provides no functionality — the install-time beacon is the sole behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms easypanel-core@1.0.0 as malicious (MAL-2026-15897): Malicious code in easypanel-core (npm)