MAL-2026-16074

    Dashboard / Malicious Package / MAL-2026-16074

    MAL-2026-16074

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in easypanel-deploy (npm)

    Details: Source: amazon-inspector (0ac486399ab6c99cf83bfcf80e487c414fd29430e27f0d929ff7034ed333c7e8) The package's preinstall lifecycle script runs automatically on `npm install` and collects installer-side identifiers — `os.hostname()`, `os.userInfo().username`, the current working directory, and CI-related environment variable names — base64url-encodes them, and sends them to a hardcoded third-party out-of-band collector under `oob.lyomeri.com` via both a DNS lookup (`easypanel-deploy.<chunk>daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com`) and an HTTP GET request to the same host. The behavior fires without user consent on install, exfiltrates host reconnaissance data to an attacker-controlled endpoint, and is consistent with a dependency-confusion / beacon package. An in-source comment labeling this as a 'benign canary' does not change the observable behavior.

    References: https://www.npmjs.com/package/easypanel-deploy/v/1.0.0

    Affected packages

    Package

    Name: easypanel-deploy

    Purl: pkg:npm/easypanel-deploy

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0