nice-utils-helper@1.0.0: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 3h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14248 confirms this npm version as malicious. The npm package nice-utils-helper@1.0.0 executes probe.js from its postinstall lifecycle. On install, probe.js issues requests to cloud instance-metadata service endpoints (AWS 169.254.169.254, Aliyun 100.100.100.200, Tencent metadata.tencentyun.com, 169.254.0.23) using curl/http.request/GET and records per-target reachability along with the host's hostname and cwd. It then writes NCODE_META.txt and...

Advisory

MAL-2026-14248

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in nice-utils-helper (npm)

Details

The npm package nice-utils-helper@1.0.0 executes probe.js from its postinstall lifecycle. On install, probe.js issues requests to cloud instance-metadata service endpoints (AWS 169.254.169.254, Aliyun 100.100.100.200, Tencent metadata.tencentyun.com, 169.254.0.23) using curl/http.request/GET and records per-target reachability along with the host's hostname and cwd. It then writes NCODE_META.txt and NCODE_POC_MARKER.txt into the current directory as well as../ and../.., leaving beacon/marker artifacts above the package root. The package advertises itself as a 'game metadata' utility and self-labels the probing as an 'Authorized PoC', but the executed behavior is unsolicited cloud-environment reconnaissance and cross-directory file writes on the installer's machine at install time, unrelated to any advertised utility functionality.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.11 KB of source

Source & flagged code

2 flagged

package.jsonView file

•scripts.postinstall = node probe.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

probe.jsView file

3var path = require('path'); L4: var http = require('http'); L5: var os = require('os'); L6: L7: var cwd = process.cwd(); L8: var lines = ['meta-probe', 'cwd=' + cwd, 'host=' + (function(){try{return os.hostname();}catch(e){return '?';}})()]; L9: ... L20: req.on('error', function (e) { if (!done) { done = true; resolve('ERR:' + (e.code || 'conn')); } }); L21: req.end(); L22: } catch (e) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

probe.jsView on unpkg · L3

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node probe.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

probe.jsView file

3var path = require('path'); L4: var http = require('http'); L5: var os = require('os'); L6: L7: var cwd = process.cwd(); L8: var lines = ['meta-probe', 'cwd=' + cwd, 'host=' + (function(){try{return os.hostname();}catch(e){return '?';}})()]; L9: ... L20: req.on('error', function (e) { if (!done) { done = true; resolve('ERR:' + (e.code || 'conn')); } }); L21: req.end(); L22: } catch (e) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

probe.jsView on unpkg · L3

Findings

2 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessprobe.js

MediumNetwork

LowScripts Present

LowFilesystem