keroeltop

{"schema_version":"1.7.4","id":"MAL-2026-16297","published":"2026-09-18T23:41:11Z","modified":"2026-09-21T03:48:01.737648681Z","summary":"Malicious code in keroeltop (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199)\nkeroeltop@99.99.99 is a lure package whose index.js runs on every npm lifecycle phase (preinstall/install/postinstall/prepare) and issues an HTTP request to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/<packages>?h=<hostname>, transmitting the installer's os.hostname() to an attacker-controlled Pipedream webhook. The version number 99.99.99 is the canonical dependency-confusion resolution-winning shape used to override an internal package name. The package additionally declares a dependency on `requests@^0.3.0` (an npm name resembling `request`) and requires it at the top of index.js, causing whatever bytes resolve for that name to be fetched and loaded transitively at install time. No legitimate functionality is present.\n\n## Source: ossf-package-analysis (89aae084914d96e7e7620a79371083c4e1bb4a838fac1633aff257c5a380eab8)\nThe OpenSSF Package Analysis project identified 'keroeltop' @ 99.99.99 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"keroeltop","ecosystem":"npm"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"29c76f4e298a29804ee501499e4bec494249577ef5565ffab49e39b4ac7f8ebb","tlsh":"3dd0a7c703d9b3506ae14cc0e0160607774af13771a845b8a14c938549e28a105a35c0"},{"path":"package.json","sha256":"488b99bb47a15dfe24f680d3216cf9593ee4afb1046864ea7a813372b42a09b8","tlsh":"6df04971dc505e5320bc15e4756a2d07f1521f6b439c1d4b34f3f1dd76e1522809e72a"}],"package_integrity":[{"filename":"keroeltop-99.99.99.tgz","hashes":{"sha1":"2c9025652cb8a84fc3be7b9733e40e51380af90d","sha512_sri":"sha512-jxB88MQo9UyyL3mlpJUeCaXaw9CrbJFOatFoAPtK4wrDrEmurXLx6V3Ud49hlQwRrCAca/M+Gb1Pro4LuEUTlw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/keroeltop/v/99.99.99"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-19T00:46:16.668706167Z","modified_time":"2026-09-18T23:41:11Z","sha256":"89aae084914d96e7e7620a79371083c4e1bb4a838fac1633aff257c5a380eab8","source":"ossf-package-analysis","versions":["99.99.99"]},{"id":"IN-MAL-2026-020240","import_time":"2026-09-21T03:46:38.993861039Z","modified_time":"2026-09-21T03:32:17Z","sha256":"0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199","source":"amazon-inspector","versions":["99.99.99"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}