OpenSSF/OSV advisory MAL-2026-14237 confirms this npm version as malicious. On npm install, the package's postinstall lifecycle script collects installer host identifiers (os.hostname(), process.platform, process.arch, Node version, and package metadata) and POSTs them to a hardcoded endpoint at vpx0x956.instances.poc.jchunt.top (path /gaarf-bq) via https.request. The destination is not caller-configurable and is not related to any documented purpose of the package...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in gaarf-bq (npm)
Details
On npm install, the package's postinstall lifecycle script collects installer host identifiers (os.hostname(), process.platform, process.arch, Node version, and package metadata) and POSTs them to a hardcoded endpoint at vpx0x956.instances.poc.jchunt.top (path /gaarf-bq) via https.request. The destination is not caller-configurable and is not related to any documented purpose of the package. The package name resembles Google's ads-api-report-fetcher (gaarf) BigQuery component, consistent with dependency-confusion scaffolding that lures internal builds into resolving this public name and beaconing back host fingerprints. A self-description as a security-research canary does not change the observed behavior: installer-owned identifiers leave the machine to an author-controlled host without opt-in.
Decision reason
OpenSSF Malicious Packages via OSV confirms gaarf-bq@1.0.0 as malicious (MAL-2026-14237): Malicious code in gaarf-bq (npm)