OpenSSF/OSV advisory MAL-2026-5794 confirms this npm version as malicious. The package ships a collect.js script that imports child_process and performs an HTTP POST carrying host identifiers (hostname referenced multiple times in the same file alongside the POST sink). This pattern — child_process + hostname collection + outbound POST in a non-functional 'scan' utility — matches the host-reconnaissance / data-exfiltration shape used by dependency-confusion and recon-beacon packages...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in neural-network-scan (npm)
Details
The package ships a collect.js script that imports child_process and performs an HTTP POST carrying host identifiers (hostname referenced multiple times in the same file alongside the POST sink). This pattern — child_process + hostname collection + outbound POST in a non-functional 'scan' utility — matches the host-reconnaissance / data-exfiltration shape used by dependency-confusion and recon-beacon packages. The package name and minimal surface are consistent with a recon lure rather than a useful library. Installing or requiring this package causes installer host data to be sent to an external endpoint.
Decision reason
OSV/OpenSSF confirms neural-network-scan@1.0.9 as malicious package MAL-2026-5794. Malicious code in neural-network-scan (npm)