OpenSSF/OSV advisory MAL-2026-14394 confirms this npm version as malicious. package.json declares preinstall and postinstall lifecycle scripts that invoke curl over plain HTTP to a hardcoded bare-IP endpoint (http://16.192.173.5/sm-apikey-model/pre and.../post). The path segment embeds the package name, so the operator of that endpoint receives a callback confirming each host that installed this specific package, along with the installer's source IP. The version number (99.0.0) and the...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in sm-apikey-model (npm)
Details
package.json declares preinstall and postinstall lifecycle scripts that invoke curl over plain HTTP to a hardcoded bare-IP endpoint (http://16.192.173.5/sm-apikey-model/pre and.../post). The path segment embeds the package name, so the operator of that endpoint receives a callback confirming each host that installed this specific package, along with the installer's source IP. The version number (99.0.0) and the dependency-confusion beacon shape are consistent with a namespace-squat reconnaissance package rather than a functional library.
Decision reason
OpenSSF Malicious Packages via OSV confirms sm-apikey-model@99.0.0 as malicious (MAL-2026-14394): Malicious code in sm-apikey-model (npm)