MAL-2026-11069

Dashboard / Malicious Package / MAL-2026-11069

MAL-2026-11069

Summary: Malicious code in clerk-next-fix-auth-protection (npm)

Details: Source: amazon-inspector (4fd8aaf2fc6ca964eed6950b6868486125905bacabe6b8bb1cbd581bb6a59f4c) [email protected] is a typosquat of Clerk/Next.js auth tooling that ships no functional code (declared main index.js is absent from the tarball). Both preinstall and postinstall lifecycle hooks in package.json run a plain-HTTP curl to http://u3ukeehm.requestrepo.com/depconf/clerk-next-fix-auth-protection/ with the installer's username (whoami), hostname, current working directory, and timestamp embedded in the query string. The beacon fires unconditionally on npm install, targets an anonymous requestrepo.com subdomain, and constitutes a dependency-confusion/typosquat reconnaissance probe that exfiltrates installer identity to an attacker-controlled endpoint. Source: ossf-package-analysis (11ae257db932f3501d4f9168d9fb3c7abbdb1c6dad37f5bab183785662b3d9b6) The OpenSSF Package Analysis project identified 'clerk-next-fix-auth-protection' @ 8.8.8 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/clerk-next-fix-auth-protection/v/8.8.8, https://www.npmjs.com/package/clerk-next-fix-auth-protection/v/7.7.7