OpenSSF/OSV advisory MAL-2026-12431 confirms this npm version as malicious. index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname, username, and home directory. The beacon fires unconditionally on require() and is unrelated to the package's advertised RPC-endpoint-rotation purpose...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in rpc-endpoint-rotator (npm)
Details
index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname, username, and home directory. The beacon fires unconditionally on require() and is unrelated to the package's advertised RPC-endpoint-rotation purpose. Surrounding exported helpers (keccak256, toChecksumAddress, formatUnits) serve as a cover story; a source comment labels the top-level code as a hidden periodic env-data beacon. Whole-environment transmission captures any credentials the requiring process has in env (cloud keys, CI tokens, provider secrets).
Decision reason
OpenSSF Malicious Packages via OSV confirms rpc-endpoint-rotator@1.0.0 as malicious (MAL-2026-12431): Malicious code in rpc-endpoint-rotator (npm)