Malicious code in easypanel-api-client (npm)
Affects easypanel-api-clientSource GCVE Database
Rated by Threat Radar
Data as of 09/09/2026, 13:59:59 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmeasypanel-api-client | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing easypanel-api-client version 1.0.0. Verify dependencies carefully to prevent supply chain attacks involving malicious or squatted packages. Monitor package sources and use trusted registries.
Description
The easypanel-api-client npm package version 1.0.0 contains malicious code that executes a preinstall script during installation. This script collects environment identifiers such as hostname, username, current working directory, and CI-related environment variables, encodes this data, and transmits it via DNS and HTTP requests to a remote server. The package itself exports no functional code and acts as a beacon for data exfiltration, consistent with dependency confusion or namespace squatting tactics.
Impact
The malicious preinstall script can leak sensitive environment information from the system where the package is installed. This data exposure could aid attackers in reconnaissance or further targeted attacks. There is no functional code in the package, so the impact is limited to information disclosure during installation. No known exploits in the wild have been reported.
Summary
The easypanel-api-client npm package (version 1.0.0) includes a preinstall lifecycle script that runs automatically when the package is installed. This script gathers sensitive installer-side information including hostname, username, current working directory, and names of continuous integration environment variables. It then base64url-encodes this data and sends it to a subdomain of oob.lyomeri.com using both DNS lookups and HTTP POST requests. The package exports an empty module and serves solely as a data exfiltration beacon, aligning with known dependency confusion or namespace squatting attack patterns targeting internal package names.