OpenSSF/OSV advisory MAL-2026-12065 confirms this npm version as malicious. greatcall-customers-commandapi@99.0.0 is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declares preinstall, install, and postinstall lifecycle scripts all invoking `node index.js`. On any of the three install hooks, index.js collects host identifiers (os.hostname(), os.userInfo(), homedir, platform, cwd, network interfaces), captures the output of `whoami` and...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in greatcall-customers-commandapi (npm)
Details
greatcall-customers-commandapi@99.0.0 is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declares preinstall, install, and postinstall lifecycle scripts all invoking `node index.js`. On any of the three install hooks, index.js collects host identifiers (os.hostname(), os.userInfo(), homedir, platform, cwd, network interfaces), captures the output of `whoami` and `ls -la` via child_process.execSync, and enumerates process.env filtering for credential-shaped keys matching /KEY|SECRET|TOKEN|PASS|AUTH|CRED|PRIVATE|AWS_|AZURE_|GCP_|GITHUB|NPM|DB_|DATABASE|API|WEBHOOK|JENKINS|OCTOPUS|CONNECTION/i, then POSTs the collected payload to a hardcoded webhook at https://test.v3n.my/pwn via https.request. The 99.0.0 version and internal-sounding name are the canonical dependency-confusion shape used to override a private registry package of the same name.
Decision reason
OpenSSF Malicious Packages via OSV confirms greatcall-customers-commandapi@99.0.0 as malicious (MAL-2026-12065): Malicious code in greatcall-customers-commandapi (npm)