Malicious code in easypanel-ctl (npm)

The easypanel-ctl npm package version 1.0.0 includes a preinstall lifecycle script that gathers installer host details such as hostname, username, current working directory, and enumerates CI-related environment variables. This collected data is base64url-encoded, split into DNS label-sized chunks, and exfiltrated through DNS queries and HTTP GET requests to a hardcoded subdomain of oob.lyomeri.com. The package exports an empty stub object, indicating it has no legitimate runtime functionality and serves solely as a reconnaissance beacon. The domain used for exfiltration is unrelated to the official easypanel.io publisher, consistent with a dependency confusion attack designed to trick users into installing a malicious package in place of an internal or unrelated easypanel package.

Installation of easypanel-ctl version 1.0.0 results in unauthorized collection and exfiltration of sensitive environment and host information to an attacker-controlled domain. This compromises confidentiality of build and host environment details, potentially aiding further attacks or reconnaissance. The package does not provide any legitimate functionality and solely acts as a covert data exfiltration channel during installation.

No official patch or remediation is currently documented. Users should avoid installing easypanel-ctl version 1.0.0 and verify package authenticity before installation. Implementing strict package source verification and dependency resolution policies can help prevent dependency confusion attacks. Monitor for and remove any installations of this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.