Malicious code in easypanel-client (npm)

The easypanel-client npm package version 1.0.0 includes a preinstall script that gathers sensitive environment information from the installer system, including hostname, OS username, current working directory, and continuous integration environment variables. This data is base64url-encoded and transmitted via DNS lookup and HTTP GET request to a hardcoded out-of-band domain easypanel-client.<subdomain>.oob.lyomeri.com. The package's index.js exports an empty object, indicating no runtime functionality beyond the install-time beacon. This suggests the package is a malicious dependency confusion probe designed to collect environment data from systems attempting to install easypanel-related packages.

Installation of easypanel-client version 1.0.0 results in unintended leakage of environment information to an external attacker-controlled server. This can expose sensitive system details that may aid further attacks or reconnaissance. There is no indication of direct code execution beyond the preinstall hook or persistence mechanisms. The impact is primarily information disclosure during package installation.

No official patch or remediation is documented. Users should avoid installing easypanel-client version 1.0.0 and audit their dependency sources to prevent dependency confusion attacks. Verify package authenticity before installation, especially for internal or private package namespaces. Monitor for and remove any installations of this package. Patch status is not yet confirmed — check vendor advisories or npm security notices for updates.