OpenSSF/OSV advisory MAL-2026-5764 confirms this npm version as malicious. The package's collect.js gathers host identifiers (os.hostname(), os.homedir()) along with filesystem and child_process introspection and POSTs them to a hardcoded external endpoint at http://aab.sportsontheweb.net. The destination is unrelated to any legitimate npm distribution infrastructure and the data flow has no documented purpose tied to the package's stated function...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in sys-info-cli-app (npm)
Details
The package's collect.js gathers host identifiers (os.hostname(), os.homedir()) along with filesystem and child_process introspection and POSTs them to a hardcoded external endpoint at http://aab.sportsontheweb.net. The destination is unrelated to any legitimate npm distribution infrastructure and the data flow has no documented purpose tied to the package's stated function. The combination of os/child_process/fs reads with an outbound POST to an attacker-controlled domain is the canonical host-reconnaissance / exfiltration shape. Installing or loading this package causes installer host metadata to be sent off-host to a third-party server.
Decision reason
OSV/OpenSSF confirms sys-info-cli-app@1.0.9 as malicious package MAL-2026-5764. Malicious code in sys-info-cli-app (npm)