Malicious code in easypanel-docker (npm)

The easypanel-docker npm package version 1.0.0 includes a preinstall script that collects sensitive host environment information such as os.hostname(), os.userInfo().username, process.cwd(), and CI-related environment variables. This data is base64url-encoded, sanitized for DNS-safe characters, chunked into ≤50-character DNS labels, and exfiltrated via DNS lookup requests and HTTP GET requests to a hardcoded out-of-band domain easypanel-docker.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com. The dual-channel exfiltration technique and the package's name suggest a dependency confusion or typosquatting attack. The package fires this behavior automatically on npm install. Despite an in-source comment labeling this as a benign canary, the actual behavior constitutes malicious data exfiltration.

This malicious package can leak sensitive host environment information to an attacker-controlled domain during installation, potentially exposing system identifiers and CI environment variables. This can lead to reconnaissance that supports further attacks or compromise. There is no evidence of active exploitation in the wild reported. The impact is limited to systems that install this specific malicious package version.

No official patch or remediation is indicated. Users should avoid installing the easypanel-docker package version 1.0.0 from untrusted sources. Verify package authenticity before installation and monitor for typosquatting or dependency confusion attacks. Remove the package if already installed. Since this is a malicious package, the best mitigation is to avoid its use.