MAL-2026-16073

    Dashboard / Malicious Package / MAL-2026-16073

    MAL-2026-16073

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in easypanel-api-client (npm)

    Details: Source: amazon-inspector (cef6da51fcc215c514680417cfd3bacb5725b91a5b4a058fd6d2b161106209b0) The package ships an empty library body (index.js exports {}) and a preinstall lifecycle script that runs automatically on npm install. The preinstall script collects installer-side identifiers — hostname, username, current working directory, and the names of CI-related environment variables — base64url-encodes them, and transmits them via both a DNS lookup and an HTTP request to a subdomain of oob.lyomeri.com (e.g. easypanel-api-client.<encoded-chunk>.oob.lyomeri.com, with the HTTP variant POSTing to /npm/<encoded>). The package has no functional code beyond this beacon, matching the dependency-confusion / namespace-squat research-beacon shape targeting internal package names.

    References: https://www.npmjs.com/package/easypanel-api-client/v/1.0.0

    Affected packages

    Package

    Name: easypanel-api-client

    Purl: pkg:npm/easypanel-api-client

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0