Malicious code in easypanel-api-client (npm)
The easypanel-api-client npm package version 1.0.0 contains malicious code that executes a preinstall script during installation. This script collects environment identifiers such as hostname, username, current working directory, and CI-related environment variables, encodes this data, and transmits it via DNS and HTTP requests to a remote server. The package itself exports no functional code and acts as a beacon for data exfiltration, consistent with dependency confusion or namespace squatting tactics.
AI Analysis
Technical Summary
The easypanel-api-client npm package (version 1.0.0) includes a preinstall lifecycle script that runs automatically when the package is installed. This script gathers sensitive installer-side information including hostname, username, current working directory, and names of continuous integration environment variables. It then base64url-encodes this data and sends it to a subdomain of oob.lyomeri.com using both DNS lookups and HTTP POST requests. The package exports an empty module and serves solely as a data exfiltration beacon, aligning with known dependency confusion or namespace squatting attack patterns targeting internal package names.
Potential Impact
The malicious preinstall script can leak sensitive environment information from the system where the package is installed. This data exposure could aid attackers in reconnaissance or further targeted attacks. There is no functional code in the package, so the impact is limited to information disclosure during installation. No known exploits in the wild have been reported.
Mitigation Recommendations
No official patch or remediation is currently documented for this package. Users should avoid installing easypanel-api-client version 1.0.0. Verify dependencies carefully to prevent supply chain attacks involving malicious or squatted packages. Monitor package sources and use trusted registries. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Malicious code in easypanel-api-client (npm)
Description
The easypanel-api-client npm package version 1.0.0 contains malicious code that executes a preinstall script during installation. This script collects environment identifiers such as hostname, username, current working directory, and CI-related environment variables, encodes this data, and transmits it via DNS and HTTP requests to a remote server. The package itself exports no functional code and acts as a beacon for data exfiltration, consistent with dependency confusion or namespace squatting tactics.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The easypanel-api-client npm package (version 1.0.0) includes a preinstall lifecycle script that runs automatically when the package is installed. This script gathers sensitive installer-side information including hostname, username, current working directory, and names of continuous integration environment variables. It then base64url-encodes this data and sends it to a subdomain of oob.lyomeri.com using both DNS lookups and HTTP POST requests. The package exports an empty module and serves solely as a data exfiltration beacon, aligning with known dependency confusion or namespace squatting attack patterns targeting internal package names.
Potential Impact
The malicious preinstall script can leak sensitive environment information from the system where the package is installed. This data exposure could aid attackers in reconnaissance or further targeted attacks. There is no functional code in the package, so the impact is limited to information disclosure during installation. No known exploits in the wild have been reported.
Mitigation Recommendations
No official patch or remediation is currently documented for this package. Users should avoid installing easypanel-api-client version 1.0.0. Verify dependencies carefully to prevent supply chain attacks involving malicious or squatted packages. Monitor package sources and use trusted registries. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16073
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6aa15f82acd9273b496184d4
Added to database: 09/09/2026, 13:30:42 UTC
Last enriched: 09/09/2026, 13:59:59 UTC
Last updated: 09/09/2026, 23:50:01 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.