registry / magika-js / 4.1.1

magika-js@4.1.1

OSV Malicious Advisory

scanned 3h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14247 confirms this npm version as malicious. magika-js is a typosquat of Google's magika library. The postinstall lifecycle script collects installer host identifiers (hostname, platform, arch, node version, package name, npm lifecycle event, timestamp) and POSTs them as JSON to the hardcoded endpoint https://ucjtw03t.instances.poc.jchunt.top/magika-js...

Advisory

MAL-2026-14247

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in magika-js (npm)

Details

magika-js is a typosquat of Google's magika library. The postinstall lifecycle script collects installer host identifiers (hostname, platform, arch, node version, package name, npm lifecycle event, timestamp) and POSTs them as JSON to the hardcoded endpoint https://ucjtw03t.instances.poc.jchunt.top/magika-js. The beacon fires automatically on npm install with no opt-in and no documented purpose served by the transmission, sending installer machine data to a non-publisher domain. A source.txt pointer to github.com/google/magika reinforces the impersonation of Google's project.

Decision reason

High-risk behavior combination matched malicious policy.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 666 B of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

2const os = require("os"); L3: const https = require("https"); L4: ... L6: timestamp: new Date().toISOString(), L7: pkg: process.env.npm[redacted], L8: hostname: os.hostname(), L9: platform: process.platform, ... L25: req.on("error", () => {}); // Don't interfere with installation. L26: req.write(metadata); L27: req.end();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

postinstall.jsView on unpkg · L2

2Trigger-reachable chain: scripts.postinstall -> postinstall.js L2: const os = require("os"); L3: const https = require("https"); L4: ... L6: timestamp: new Date().toISOString(), L7: pkg: process.env.npm[redacted], L8: hostname: os.hostname(), L9: platform: process.platform, ... L25: req.on("error", () => {}); // Don't interfere with installation. L26: req.write(metadata); L27: req.end();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L2

2Trigger-reachable credential exfiltration chain: scripts.postinstall -> postinstall.js L2: const os = require("os"); L3: const https = require("https"); L4: ... L6: timestamp: new Date().toISOString(), L7: pkg: process.env.npm[redacted], L8: hostname: os.hostname(), L9: platform: process.platform, ... L25: req.on("error", () => {}); // Don't interfere with installation. L26: req.write(metadata); L27: req.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

postinstall.jsView on unpkg · L2

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

postinstall.jsView on unpkg · L2

Findings

2 Critical2 High4 Medium1 Low

CriticalCredential Exfiltrationpostinstall.js

CriticalTrigger Reachable Dangerous Capabilitypostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Credential Exfiltrationpostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present