MAL-2026-18519

Dashboard / Malicious Package / MAL-2026-18519

MAL-2026-18519

Summary: Malicious code in service-roles-registry (npm)

Details: service-roles-registry runs code during `npm install` that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint: - 99.0.2 (published 2026-11-02 17:53 UTC): its `preinstall` script is `node index.js`, which npm runs during `npm install`. In `index.js` (SHA-256 `ca719dd4b07aeddffaf59facde11726e981bad6d15620b47407f943ea00bb496`), lines 9-15 contain a request address on a public request-collection service, `https://eog6t9e6egptozp.m.pipedream.net` (line 15), a read of the machine's identity, `os.hostname()` (line 9), a read of the machine's identity, `os.userInfo()` (line 10) and a network request call, `https.request(` (line 15). The code is quoted from the published archive. Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0) [email protected] runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.

References: https://www.npmjs.com/package/service-roles-registry/v/99.0.2