OpenSSF/OSV advisory MAL-2026-14267 confirms this npm version as malicious. On npm install, the package's postinstall lifecycle script collects host identifiers (os.hostname(), platform, arch, Node.js version, package name, lifecycle event) and POSTs them as JSON to a hardcoded non-first-party endpoint at https://e14giapf.instances.poc.jchunt.top/karma-proxy...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in karma-proxy (npm)
Details
On npm install, the package's postinstall lifecycle script collects host identifiers (os.hostname(), platform, arch, Node.js version, package name, lifecycle event) and POSTs them as JSON to a hardcoded non-first-party endpoint at https://e14giapf.instances.poc.jchunt.top/karma-proxy. The beacon fires unconditionally on every install, with no user opt-in, no configuration, and no disclosure in the package's advertised purpose. The destination is an author-controlled subdomain unrelated to any npm registry or vendor infrastructure.
Decision reason
OpenSSF Malicious Packages via OSV confirms karma-proxy@1.0.0 as malicious (MAL-2026-14267): Malicious code in karma-proxy (npm)