Malicious code in easypanel-app (npm)

The easypanel-app package (version 1.0.0) includes a preinstall script that automatically executes during npm install. This script gathers system and environment information such as os.hostname(), os.userInfo().username, process.cwd(), and CI environment variables. It then serializes this data to JSON, encodes it with base64url, chunks it into DNS label format, and sends it out-of-band to a hardcoded third-party collector domain via dns.lookup() and HTTP GET requests. This behavior constitutes a dependency-confusion reconnaissance beacon that discloses installer identity and internal package name information to an external entity, regardless of any benign labeling within the package.

The malicious preinstall script leaks sensitive environment information including hostnames, usernames, current working directories, and CI environment variables to an external third party. This can lead to exposure of internal infrastructure details and potentially facilitate further targeted attacks or reconnaissance by adversaries. There is no indication of direct code execution or system compromise beyond data exfiltration in the provided information.

No official patch or remediation guidance is provided in the available data. Users should avoid installing easypanel-app version 1.0.0 from untrusted sources. Verify package authenticity before installation and consider removing or blocking the package if already installed. Monitor for updates or advisories from the package maintainers or npm registry for any official fixes or removals.