OpenSSF/OSV advisory MAL-2026-5778 confirms this npm version as malicious. On `npm install`, the package's preinstall script (postinstall.js) collects host metadata (hostname, username, cwd, npm config) and iterates process.env, filtering keys against the regex /key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i to harvest credential-shaped variables. The resulting JSON payload is POSTed over HTTPS to a hardcoded bare-IP endpoint,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in hemi-earn-actions (npm)
Details
On `npm install`, the package's preinstall script (postinstall.js) collects host metadata (hostname, username, cwd, npm config) and iterates process.env, filtering keys against the regex /key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i to harvest credential-shaped variables. The resulting JSON payload is POSTed over HTTPS to a hardcoded bare-IP endpoint, https://185.130.46.35:8443/collect. The package itself has no functional API — index.js is `module.exports = {}` — and the version `999.0.0` plus the description 'Internal package' fit the dependency-confusion pattern aimed at organizations that resolve a private name `hemi-earn-actions` from the public registry. Installer harm is automatic credential exfiltration of CI/developer secrets to attacker-controlled infrastructure.
Decision reason
OSV/OpenSSF confirms hemi-earn-actions@999.0.0 as malicious package MAL-2026-5778. Malicious code in hemi-earn-actions (npm)