keroeltopkk

{"modified":"2026-09-21T03:32:08Z","published":"2026-09-21T03:32:08Z","schema_version":"1.7.4","id":"MAL-2026-16335","summary":"Malicious code in keroeltopkk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc)\nPackage keroeltopkk@99.99.99 ships only a manifest and a beacon script (server.js) and wires it into every npm lifecycle hook (preinstall/install/postinstall/prepare), so `npm install` auto-executes it. server.js reads os.hostname() and issues an HTTPS GET to https://eo8f3m3ho26a0nm.m.pipedream.net/${packageName}?h=${hostname}, a Pipedream request-bin acting as an attacker-controlled collector. The package version 99.99.99, empty description, absence of any real functionality, and duplicated Dependencies/dependencies keys are consistent with a dependency-confusion reconnaissance squat: the attacker publishes a high-version stub under a name that may match an internal/private package so that misconfigured resolvers pull the public stub and beacon the victim's hostname back on install.\n","affected":[{"package":{"ecosystem":"npm","name":"keroeltopkk"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"server.js","sha256":"5f260d84ddfa5ac81d1f76e1966f0d67a90e933cd49415d9dd0aa8a1a1bc0b24","tlsh":"03d0a7c703e5b7506ae14cc0e0170647675af13771a885b8a14c83c549e3ca105a35c0"},{"path":"package.json","sha256":"ef3ab41c25285455bd198c9fc6b35c955926a144e73efcc2f47a6dc0b21ee602","tlsh":"83f03111dc445e6720bc15ac25d41603f724aeab839c1d0b35f3f1df2ea252e2156a2a"}],"package_integrity":[{"filename":"keroeltopkk-99.99.99.tgz","hashes":{"sha1":"ace1b606be90231326d452016ef241a9d9039e58","sha512_sri":"sha512-o1Sc6ih7JtWsW1PG6tcDXXT46RlnL8We3PyrHuf7sMAGOuMBwlcBVR7zVZkK5Bg9T0nIOisN4HFCdDh7UQjzfA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/keroeltopkk/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020239","import_time":"2026-09-21T03:46:38.848717821Z","modified_time":"2026-09-21T03:32:08Z","sha256":"b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc","source":"amazon-inspector","versions":["99.99.99"]}]}}