Malicious code in com.epi.e2e_test (npm)
The npm package com.epi.e2e_test version 1.2.2 contains malicious code that executes automatically during installation. A preinstall script runs an index.js file which collects host-specific identifiers such as the home directory, hostname, username, DNS servers, current working directory, and the package.json contents. This data is then sent via HTTPS to a hardcoded external server (meta.brs.cx) without user consent. This behavior is indicative of reconnaissance activity commonly associated with dependency confusion or internal name attacks.
AI Analysis
Technical Summary
The com.epi.e2e_test npm package version 1.2.2 includes a preinstall script that triggers execution of index.js upon npm install. The script gathers sensitive host environment information including os.homedir(), os.hostname(), os.userInfo().username, dns.getServers(), current working directory, and the package.json file contents. This information is exfiltrated over HTTPS to a hardcoded external domain meta.brs.cx. The automatic execution and data collection without user interaction characterize this as malicious reconnaissance code likely used to identify targets for subsequent attacks such as dependency confusion.
Potential Impact
The malicious code compromises user privacy by collecting detailed host environment data and sending it to an external attacker-controlled server. This can facilitate targeted follow-on attacks by revealing internal network and system information. The automatic execution on install increases the risk of unnoticed data exfiltration in environments where this package is used.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 1.2.2 of com.epi.e2e_test. Review and audit dependencies for unexpected preinstall scripts or external communications. Consider using package integrity verification and restricting installation of untrusted packages. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue.
Malicious code in com.epi.e2e_test (npm)
Description
The npm package com.epi.e2e_test version 1.2.2 contains malicious code that executes automatically during installation. A preinstall script runs an index.js file which collects host-specific identifiers such as the home directory, hostname, username, DNS servers, current working directory, and the package.json contents. This data is then sent via HTTPS to a hardcoded external server (meta.brs.cx) without user consent. This behavior is indicative of reconnaissance activity commonly associated with dependency confusion or internal name attacks.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The com.epi.e2e_test npm package version 1.2.2 includes a preinstall script that triggers execution of index.js upon npm install. The script gathers sensitive host environment information including os.homedir(), os.hostname(), os.userInfo().username, dns.getServers(), current working directory, and the package.json file contents. This information is exfiltrated over HTTPS to a hardcoded external domain meta.brs.cx. The automatic execution and data collection without user interaction characterize this as malicious reconnaissance code likely used to identify targets for subsequent attacks such as dependency confusion.
Potential Impact
The malicious code compromises user privacy by collecting detailed host environment data and sending it to an external attacker-controlled server. This can facilitate targeted follow-on attacks by revealing internal network and system information. The automatic execution on install increases the risk of unnoticed data exfiltration in environments where this package is used.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 1.2.2 of com.epi.e2e_test. Review and audit dependencies for unexpected preinstall scripts or external communications. Consider using package integrity verification and restricting installation of untrusted packages. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-17415
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6abd30702a4e24523d33fed5
Added to database: 09/30/2026, 15:53:20 UTC
Last enriched: 09/30/2026, 15:54:43 UTC
Last updated: 09/30/2026, 22:42:07 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.