OpenSSF/OSV advisory MAL-2026-14061 confirms this npm version as malicious. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it collects os.hostname(), os.platform(), os.networkInterfaces(), cwd, uid, the output of `id`, a full process.env dump, /proc/self/environ, a root filesystem listing, and the contents of ~/.npmrc, and specifically reads AWS_CONTAINER_CREDENTIALS_RELATIVE_URI...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in hunterone-build-probe-9210 (npm)
Details
probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it collects os.hostname(), os.platform(), os.networkInterfaces(), cwd, uid, the output of `id`, a full process.env dump, /proc/self/environ, a root filesystem listing, and the contents of ~/.npmrc, and specifically reads AWS_CONTAINER_CREDENTIALS_RELATIVE_URI. The collected JSON payload is POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/22508080-b099-4ec3-8ab7-7354af2886a9/buildenv. ~/.npmrc contains the installer's npm registry auth token, and the AWS ECS credential-endpoint variable exposes the path to fetch task-role AWS credentials; both are installer-owned secrets shipped to an anonymous third-party collector at install time.
Decision reason
OpenSSF Malicious Packages via OSV confirms hunterone-build-probe-9210@1.0.6 as malicious (MAL-2026-14061): Malicious code in hunterone-build-probe-9210 (npm)