MAL-2026-16297

    Dashboard / Malicious Package / MAL-2026-16297

    MAL-2026-16297

    Published: 18 Sept 2026Last Modified: 21 Sept 2026

    Summary: Malicious code in keroeltop (npm)

    Details: Source: amazon-inspector (0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199) [email protected] is a lure package whose index.js runs on every npm lifecycle phase (preinstall/install/postinstall/prepare) and issues an HTTP request to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/<packages>?h=<hostname>, transmitting the installer's os.hostname() to an attacker-controlled Pipedream webhook. The version number 99.99.99 is the canonical dependency-confusion resolution-winning shape used to override an internal package name. The package additionally declares a dependency on `requests@^0.3.0` (an npm name resembling `request`) and requires it at the top of index.js, causing whatever bytes resolve for that name to be fetched and loaded transitively at install time. No legitimate functionality is present. Source: ossf-package-analysis (89aae084914d96e7e7620a79371083c4e1bb4a838fac1633aff257c5a380eab8) The OpenSSF Package Analysis project identified 'keroeltop' @ 99.99.99 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://www.npmjs.com/package/keroeltop/v/99.99.99

    Affected packages

    Package

    Name: keroeltop

    Purl: pkg:npm/keroeltop

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.99.99