MAL-2026-16072

    Dashboard / Malicious Package / MAL-2026-16072

    MAL-2026-16072

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in easypanel-agent (npm)

    Details: Source: amazon-inspector (7eb103b6863369372ba8c07701264f8b0f6b57e3217e07912c8efbd9371c648f) The package's preinstall lifecycle script (preinstall.js) executes automatically on `npm install` and collects the installer's hostname, OS username, current working directory, and CI-related environment variable names. The collected data is base64-encoded and transmitted to a hardcoded out-of-band collector under lyomeri.com via both a DNS lookup (encoding data into a subdomain label under easypanel-agent.<data>.oob.lyomeri.com) and an HTTP GET request to the same host. The package's main entry, index.js, is an empty stub (`module.exports = {}`), so the install-time beacon is the sole functional behavior. The package name mimics the 'easypanel' product, consistent with a dependency-confusion or typosquat delivery vehicle. An in-source comment self-labeling the code as a 'benign canary' does not change that installer-controlled data leaves the machine without consent to an author-controlled endpoint.

    References: https://www.npmjs.com/package/easypanel-agent/v/1.0.0

    Affected packages

    Package

    Name: easypanel-agent

    Purl: pkg:npm/easypanel-agent

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0