registry / test12vv36 / 99.99.99

test12vv36@99.99.99

OSV Malicious Advisory

imported 19d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16311 confirms this npm version as malicious. test12vv36@99.99.99 declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://128.199.122.145/?test12vv36, sending the package name in the query string and disclosing the installer's source IP to the operator of that host. The version number (99.99.99) and package.json shape (dependency on a typosquat name...

Advisory

MAL-2026-16311

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in test12vv36 (npm)

Details

test12vv36@99.99.99 declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://128.199.122.145/?test12vv36, sending the package name in the query string and disclosing the installer's source IP to the operator of that host. The version number (99.99.99) and package.json shape (dependency on a typosquat name 'requests@^0.3.0' plus a duplicate misspelled 'Dependencies' key) are consistent with a dependency-confusion or proof-of-concept publish rather than a functional library. Installing the package causes unauthenticated, unencrypted outbound network activity to attacker-controlled infrastructure at install time, confirming successful installation on the host.

Decision reason

OpenSSF Malicious Packages via OSV confirms test12vv36@99.99.99 as malicious (MAL-2026-16311): Malicious code in test12vv36 (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 High

HighOsv Malicious Advisory

Affected versions and remediation

This report applies to test12vv36@99.99.99.

See version security history for other recorded verdicts.

Avoid installing test12vv36@99.99.99. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-21 03:30:17.638Z (UTC).

Source advisory published: 2026-09-21 03:23:35.000Z (UTC).

This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.