unico-check
This report shows the evidence for unico-check@9.9.9, the only known version.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-5830 confirms this npm version as malicious.
Advisory
MAL-2026-5830
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in unico-check (npm)
Details
package.json declares a preinstall lifecycle hook that runs `curl` against `https://webhook.site/fe1246c2-ac04-4493-b223-fe34ba26b79f`, passing the installer's hostname, current user, working directory, full `uname -a` output, and `$HOME` as query parameters. The beacon fires automatically on `npm install` with no user interaction. The package ships no source files, declares no main entry, and uses the implausible version `9.9.9` — the canonical shape of a dependency-confusion / typosquat reconnaissance package targeting builds that may resolve a private `unico-check` from the public registry. The package's only effect on installation is to leak host identifiers to an anonymous, attacker-controlled webhook.site bin, staging follow-on compromise.
## Source: ossf-package-analysis (61af12e58a8af18142c41410d07328ba0dbfb7e79b145d84b2389444c27b2abc) The OpenSSF Package Analysis project identified 'unico-check' @ 9.9.9 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to unico-check@9.9.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing unico-check@9.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.