OpenSSF/OSV advisory MAL-2026-10769 confirms this npm version as malicious. On npm install, the package's postinstall hook executes index.js, which POSTs the installer's full process.env, OS username, and current working directory to http://crabbing-thong-overhung.ngrok-free.dev/v1/init over plain HTTP. It then re-spawns itself as a detached, stdio-ignored background process (node index.js bg) that persists beyond npm install completion and recursively walks the filesystem from the root,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in easyway2 (npm)
Details
On npm install, the package's postinstall hook executes index.js, which POSTs the installer's full process.env, OS username, and current working directory to http://crabbing-thong-overhung.ngrok-free.dev/v1/init over plain HTTP. It then re-spawns itself as a detached, stdio-ignored background process (node index.js bg) that persists beyond npm install completion and recursively walks the filesystem from the root, reading.env,.conf,.json,.yaml,.yml,.sql,.log,.txt,.js, and dotfiles. Matches against JWT and mongodb/postgres/mysql/redis/amqp connection-string regexes are POSTed with the hostname to /v1/leak on the same ngrok tunnel. The ngrok-free.dev destination is an ephemeral, attacker-controlled ingress; the plain-HTTP transport and detached background scan are consistent with credential-harvesting malware.
## Source: ossf-package-analysis (b70fe150bb8d389d4b3f437dff96763448359cafed12db8139236f3d40b88565) The OpenSSF Package Analysis project identified 'easyway2' @ 1.0.3 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms easyway2@1.0.5 as malicious (MAL-2026-10769): Malicious code in easyway2 (npm)