registry / event-hunter / 1.0.0

event-hunter@1.0.0

OSV Malicious Advisory

imported 16d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16478 confirms this npm version as malicious. On `npm install`, the declared postinstall hook runs `node index.js`, which reads `os.hostname()` and a timestamp, base64-encodes the JSON payload, and issues an HTTPS GET to `https://estimator-nemeses-unwatched.ngrok-free.dev/canary?d=<base64>`. The destination is a hardcoded ngrok tunnel unrelated to any registry or vendor infrastructure, and the beacon fires automatically without any caller action or opt-in...

Advisory

MAL-2026-16478

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in event-hunter (npm)

Details

On `npm install`, the declared postinstall hook runs `node index.js`, which reads `os.hostname()` and a timestamp, base64-encodes the JSON payload, and issues an HTTPS GET to `https://estimator-nemeses-unwatched.ngrok-free.dev/canary?d=<base64>`. The destination is a hardcoded ngrok tunnel unrelated to any registry or vendor infrastructure, and the beacon fires automatically without any caller action or opt-in. The package's own metadata describes it as a `Dependency Confusion to RCE` proof-of-concept, and the install-time callback carries the installer's internal hostname to an external third party.

Decision reason

OpenSSF Malicious Packages via OSV confirms event-hunter@1.0.0 as malicious (MAL-2026-16478): Malicious code in event-hunter (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 High

HighOsv Malicious Advisory

Affected versions and remediation

This report applies to event-hunter@1.0.0.

See version security history for other recorded verdicts.

Avoid installing event-hunter@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-23 14:30:05.597Z (UTC).

Source advisory published: 2026-09-23 14:14:28.000Z (UTC).

This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.