The easypanel-agent npm package version 1.0.0 includes a preinstall.js script that executes automatically during npm install. This script collects the installer's hostname, OS username, current working directory, and CI-related environment variable names. The collected data is base64-encoded and sent to a hardcoded external collector domain (lyomeri.com) via DNS queries and HTTP GET requests. The main module exports an empty object, confirming that the install-time data exfiltration is the sole functionality. The package name mimics a legitimate product, suggesting it is used for dependency confusion or typosquatting attacks. An in-source comment describes the code as a 'benign canary,' but this does not negate the unauthorized data transmission.

Installation of easypanel-agent version 1.0.0 results in unauthorized collection and exfiltration of sensitive environment and system information to an attacker-controlled server. This compromises user privacy and could facilitate further targeted attacks or reconnaissance. There is no indication of additional malicious payloads beyond data exfiltration.

No official patch or remediation is currently documented. Users should avoid installing easypanel-agent version 1.0.0 and verify dependencies carefully to prevent supply chain attacks such as typosquatting or dependency confusion. Monitor package sources and prefer official packages from trusted repositories. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.