eslint-rxjs@1.0.0

eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate redis with cookies', and the author field impersonates well-known maintainers. The package ships no advertised functionality; index.cjs contains only a beacon helper. The package.json postinstall hook runs scripts/postinstall.cjs, which loads index.cjs and calls onInstall(), unconditionally issuing an HTTP GET to the hardcoded ngrok tunnel https://e493-95-216-46-122.ngrok-free.app/ping at install time. An ngrok-free.app subdomain is ephemeral, attacker-controlled infrastructure with no legitimate use for a published package; the request confirms code execution on the installer's machine and discloses the installer's source IP and install timing to that endpoint. This is the reconnaissance stage of a supply-chain dropper. ## Source: ossf-package-analysis (994311f4267205d33ceb2b43d3f7d72767d384dcc286b6962b5cea13489f7280) The OpenSSF Package Analysis project identified 'eslint-rxjs' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.