OpenSSF/OSV advisory MAL-2026-4685 confirms this npm version as malicious. The package contains a file (poc.js) that imports os, https, fs, and child_process; collects host identifiers including os.hostname(), os.platform(), and the output of `whoami`; and POSTs the data via https.request to an external endpoint. This is a classic system-reconnaissance and exfiltration shape with no benign interpretation for a package distributed under a 'components' name...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tempo-components (npm)
Details
The package contains a file (poc.js) that imports os, https, fs, and child_process; collects host identifiers including os.hostname(), os.platform(), and the output of `whoami`; and POSTs the data via https.request to an external endpoint. This is a classic system-reconnaissance and exfiltration shape with no benign interpretation for a package distributed under a 'components' name. Installing or loading this code on a build or developer machine causes host metadata and identity information to be transmitted off-host.
Decision reason
OpenSSF Malicious Packages via OSV confirms tempo-components@99.0.1 as malicious (MAL-2026-4685): Malicious code in tempo-components (npm)