MAL-2026-15812

    Dashboard / Malicious Package / MAL-2026-15812

    MAL-2026-15812

    Published: 2 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in eslint-rxjs (npm)

    Details: Source: amazon-inspector (2794273ee7e40da4b37c017636209acf1402b1104ab5fc265a43cc7d83228e72) eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate redis with cookies', and the author field impersonates well-known maintainers. The package ships no advertised functionality; index.cjs contains only a beacon helper. The package.json postinstall hook runs scripts/postinstall.cjs, which loads index.cjs and calls onInstall(), unconditionally issuing an HTTP GET to the hardcoded ngrok tunnel https://e493-95-216-46-122.ngrok-free.app/ping at install time. An ngrok-free.app subdomain is ephemeral, attacker-controlled infrastructure with no legitimate use for a published package; the request confirms code execution on the installer's machine and discloses the installer's source IP and install timing to that endpoint. This is the reconnaissance stage of a supply-chain dropper. Source: ossf-package-analysis (994311f4267205d33ceb2b43d3f7d72767d384dcc286b6962b5cea13489f7280) The OpenSSF Package Analysis project identified 'eslint-rxjs' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://www.npmjs.com/package/eslint-rxjs/v/1.0.1, https://www.npmjs.com/package/eslint-rxjs/v/1.0.0

    Affected packages

    Package

    Name: eslint-rxjs

    Purl: pkg:npm/eslint-rxjs

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.0