OpenSSF/OSV advisory MAL-2026-10897 confirms this npm version as malicious. Package self-identifies as a security research test ('Security research test - do not install'). The package.json `homepage` field contains `javascript:alert(document.domain)`, which is an XSS probe targeting any registry or UI frontend that renders homepage values as clickable links without sanitization. The package has no lifecycle scripts (no preinstall/install/postinstall), no network I/O, and `index.js` exports...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in golan125-homepage-test (npm)
Details
Package self-identifies as a security research test ('Security research test - do not install'). The package.json `homepage` field contains `javascript:alert(document.domain)`, which is an XSS probe targeting any registry or UI frontend that renders homepage values as clickable links without sanitization. The package has no lifecycle scripts (no preinstall/install/postinstall), no network I/O, and `index.js` exports an empty object — installing or requiring this package does not harm the installer's machine. The XSS probe targets registry web UI rendering, not developers who install the package.
Decision reason
OpenSSF Malicious Packages via OSV confirms golan125-homepage-test@1.0.0 as malicious (MAL-2026-10897): Malicious code in golan125-homepage-test (npm)