OpenSSF/OSV advisory MAL-2026-13425 confirms this npm version as malicious. index.js loads https, http, and child_process at the top of the module and sends host/environment data to a hardcoded AWS Lambda URL at https://oo7fsr4cy32q42bzkpgwhy7asu0hzaod.lambda-url.us-east-1.on.aws. The code reads process.env and branches on process.platform before issuing an https.request to that endpoint...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in typst-resume-cli (npm)
Details
index.js loads https, http, and child_process at the top of the module and sends host/environment data to a hardcoded AWS Lambda URL at https://oo7fsr4cy32q42bzkpgwhy7asu0hzaod.lambda-url.us-east-1.on.aws. The code reads process.env and branches on process.platform before issuing an https.request to that endpoint. The destination is an attacker-controlled serverless URL unrelated to a Typst or resume tooling publisher, and the collected data (environment variables and host attributes) is credential-grade content leaving the installer's machine.
Decision reason
OpenSSF Malicious Packages via OSV confirms typst-resume-cli@1.0.2 as malicious (MAL-2026-13425): Malicious code in typst-resume-cli (npm)