MalwarePublished 30 Sep 2026

com.epi.e2e_test (npm) · Malicious Code

Affects com.epi.e2e_testSource GCVE Database

Malicious package : remove com.epi.e2e_test and rotate any secrets on hosts that installed it.

Data as of 30 Sep 2026, 15:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17415

What to do

Remove com.epi.e2e_test from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcom.epi.e2e_test	Affected =1.2.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package com.epi.e2e_test version 1.2.2 contains malicious code that executes automatically during installation. A preinstall script runs an index.js file which collects host-specific identifiers such as the home directory, hostname, username, DNS servers, current working directory, and the package.json contents. This data is then sent via HTTPS to a hardcoded external server (meta.brs.cx) without user consent. This behavior is indicative of reconnaissance activity commonly associated with dependency confusion or internal name attacks.

Impact

The malicious code compromises user privacy by collecting detailed host environment data and sending it to an external attacker-controlled server. This can facilitate targeted follow-on attacks by revealing internal network and system information. The automatic execution on install increases the risk of unnoticed data exfiltration in environments where this package is used.

Defensive guidance

Users should avoid installing version 1.2.2 of com.epi.e2e_test. Review and audit dependencies for unexpected preinstall scripts or external communications. Consider using package integrity verification and restricting installation of untrusted packages. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue.

Summary

The com.epi.e2e_test npm package version 1.2.2 includes a preinstall script that triggers execution of index.js upon npm install. The script gathers sensitive host environment information including os.homedir(), os.hostname(), os.userInfo().username, dns.getServers(), current working directory, and the package.json file contents. This information is exfiltrated over HTTPS to a hardcoded external domain meta.brs.cx. The automatic execution and data collection without user interaction characterize this as malicious reconnaissance code likely used to identify targets for subsequent attacks such as dependency confusion.

References

npmjs.com/package/com.epi.e2e_test/v/1.2.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 15:54 UTC

Technical details

References

Community reviews