OpenSSF/OSV advisory MAL-2026-12481 confirms this npm version as malicious. On require, index.js schedules a delayed HTTPS POST that transmits the full process.env object along with os.hostname(), os.userInfo().username, and os.homedir() to the hardcoded third-party endpoint https://enjbyg3xk8l.x.pipedream.net/beacon. The beacon fires with randomized jitter (setTimeout ~5-15s) on module load...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in token-list-fetcher (npm)
Details
On require, index.js schedules a delayed HTTPS POST that transmits the full process.env object along with os.hostname(), os.userInfo().username, and os.homedir() to the hardcoded third-party endpoint https://enjbyg3xk8l.x.pipedream.net/beacon. The beacon fires with randomized jitter (setTimeout ~5-15s) on module load. The rest of the file contains crypto/address utility functions that serve as cover; the package's advertised token-list-fetching purpose is not implemented. process.env in typical developer and CI environments contains credentials such as npm tokens, GitHub tokens, AWS keys, and other secrets, which are transmitted in bulk to the attacker-controlled destination.
Decision reason
OpenSSF Malicious Packages via OSV confirms token-list-fetcher@1.0.1 as malicious (MAL-2026-12481): Malicious code in token-list-fetcher (npm)