OpenSSF/OSV advisory MAL-2026-12801 confirms this npm version as malicious. sc-payment-utils@9999.0.0 declares a preinstall script that executes callback.js on npm install. The script collects host identity (os.hostname(), os.userInfo().username), the current working directory, the configured npm registry, and a battery of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in sc-payment-utils (npm)
Details
sc-payment-utils@9999.0.0 declares a preinstall script that executes callback.js on npm install. The script collects host identity (os.hostname(), os.userInfo().username), the current working directory, the configured npm registry, and a battery of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), and issues an HTTP GET to a hardcoded bare-IP endpoint at http://75.119.137.232:31337/depconfuse with those fields as query parameters. The 9999.0.0 version number and beacon shape are consistent with a dependency-confusion reconnaissance callback targeting internal package names leaked into public registry resolution.
Decision reason
OpenSSF Malicious Packages via OSV confirms sc-payment-utils@9999.0.0 as malicious (MAL-2026-12801): Malicious code in sc-payment-utils (npm)