registry / fanduel / 100.5.0

fanduel@100.5.0

OSV Malicious Advisory

scanned 21d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-3334 confirms this npm version as malicious. The package fanduel was found to contain malicious code.

Advisory

MAL-2026-3334

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in fanduel (npm)

Details

The package fanduel was found to contain malicious code. ## Source: ossf-package-analysis (49d980743cd761f6fb629d32e14864e720d1269e4208ec9e0f075c5e9f6eb433) The OpenSSF Package Analysis project identified 'fanduel' @ 100.5.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 14.0 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 1-13json

2 "name": "fanduel",

3 "version": "100.5.0",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "node index.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

9 "keywords": [],

10 "author": "",

11 "license": "ISC"

12}

index.jsView file

Lines 1-24javascript

1const https = require("https");

2const os = require("os");

3const dns = require(

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

4const fs = require("fs"); L5: const { exec } = require("child_process"); L6: const crypto = require("crypto");

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L4

1const https = require("https"); L2: const os = require("os"); ... L4: const fs = require("fs"); L5: const { exec } = require("child_process"); L6: const crypto = require("crypto"); ... L14: // Common CI variables L15: CI: process.env.CI || null, L16: GITHUB_ACTIONS: process.env.GITHUB_ACTIONS || null,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L1

Findings

3 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processindex.js

HighSame File Env Network Executionindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings