MAL-2026-15898

    Dashboard / Malicious Package / MAL-2026-15898

    MAL-2026-15898

    Published: 4 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in easypanel-ctl (npm)

    Details: Source: amazon-inspector (e9eb01006041231d7388c6aeb0c74288b35a8c72cf5b1e61c90e1e4f9d6d37c7) On `npm install`, the preinstall lifecycle script collects installer host identity (hostname, username, cwd) and enumerates CI-related environment variable names, base64url-encodes the collected data, chunks it into DNS labels, and transmits it via both a DNS lookup and an HTTP GET to a hardcoded subdomain of oob.lyomeri.com (e.g. easypanel-ctl.<encoded-chunk>.oob.lyomeri.com, path /npm/<encoded>). The shipped module body is a stub (`module.exports = {}`), so the package has no legitimate runtime functionality; its only effect on install is the recon beacon. The destination is an out-of-band interaction domain unrelated to the easypanel.io publisher, and the encoding plus DNS-label chunking is a covert-channel exfiltration pattern. The name `easypanel-ctl` (with an empty stub body) is consistent with a dependency-confusion lure targeting installers of an internal or unrelated `easypanel` package.

    References: https://www.npmjs.com/package/easypanel-ctl/v/1.0.0

    Affected packages

    Package

    Name: easypanel-ctl

    Purl: pkg:npm/easypanel-ctl

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0