OpenSSF/OSV advisory MAL-2026-14397 confirms this npm version as malicious. sm-checkout@99.0.0 declares preinstall and postinstall lifecycle scripts in package.json that invoke curl against a hardcoded bare-IP URL over plain HTTP (http://16.192.173.5/sm-checkout/pre and http://16.192.173.5/sm-checkout/post) on npm install. The inflated 99.0.0 version is calibrated to win semver resolution against a private package of the same name, and the lifecycle callbacks confirm successful execution on...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in sm-checkout (npm)
Details
sm-checkout@99.0.0 declares preinstall and postinstall lifecycle scripts in package.json that invoke curl against a hardcoded bare-IP URL over plain HTTP (http://16.192.173.5/sm-checkout/pre and http://16.192.173.5/sm-checkout/post) on npm install. The inflated 99.0.0 version is calibrated to win semver resolution against a private package of the same name, and the lifecycle callbacks confirm successful execution on any host that mistakenly resolves the public name, leaking the installer's source IP and install timing to the operator of 16.192.173.5. A source comment self-labels the package as a dependency-confusion test; the labelling does not change that the artifact runs an unauthenticated outbound beacon on every install in build systems and developer machines that pull it.
Decision reason
OpenSSF Malicious Packages via OSV confirms sm-checkout@99.0.0 as malicious (MAL-2026-14397): Malicious code in sm-checkout (npm)