Malicious code in easypanel-core (npm)

The easypanel-core package (npm ecosystem) version 1.0.0 is a malicious package that does not export any usable code. Its main behavior is embedded in a preinstall lifecycle script that gathers sensitive environment data including os.hostname(), os.userInfo().username, process.cwd(), and CI environment variables. This information is encoded and sent to an external domain through DNS subdomain lookups and HTTP GET requests. The package attempts to masquerade as a legitimate client library by name and description, but its sole purpose is data exfiltration during installation.

The malicious preinstall script can leak sensitive environment information from the host where the package is installed. This includes system hostname, user identity, working directory, and continuous integration environment variables. Such data exposure can aid attackers in reconnaissance or further targeted attacks. No direct code execution beyond data exfiltration is described. There is no indication of active exploitation in the wild.

No official patch or remediation is documented for this package. Users should avoid installing easypanel-core version 1.0.0 from untrusted sources. Verify package authenticity before installation and prefer official or well-maintained packages. Consider scanning dependencies for malicious behavior prior to deployment.