OpenSSF/OSV advisory MAL-2026-12788 confirms this npm version as malicious. package.json declares a preinstall hook that runs `node callback.js`, which on `npm install` collects host-level identifiers (os.hostname, os.userInfo username, current working directory, npm_config_registry) and private CI repository slugs from a broad set of provider env vars (GITHUB_REPOSITORY, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins) and transmits them via plain-HTTP GET to...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in editor_application (npm)
Details
package.json declares a preinstall hook that runs `node callback.js`, which on `npm install` collects host-level identifiers (os.hostname, os.userInfo username, current working directory, npm_config_registry) and private CI repository slugs from a broad set of provider env vars (GITHUB_REPOSITORY, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins) and transmits them via plain-HTTP GET to http://75.119.137.232:31337/depconfuse as query parameters (pkg, h, u, d, reg, ci). The version number 9999.0.0 combined with the `/depconfuse` path is the signature of a dependency-confusion beacon that maps internal package namespaces and CI topology of installing organizations to a hardcoded attacker-controlled bare-IP endpoint.
Decision reason
OpenSSF Malicious Packages via OSV confirms editor_application@9999.0.0 as malicious (MAL-2026-12788): Malicious code in editor_application (npm)