Malicious code in easypanel-hosting (npm)
Affects easypanel-hostingSource GCVE Database
Rated by Threat Radar
Data as of 09/09/2026, 14:00:10 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmeasypanel-hosting | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing easypanel-hosting@1.0.0 and audit their dependency trees for this package. Monitor for suspicious DNS and HTTP requests to unknown domains such as lyomeri.com. Consider using package integrity verification and restricting network access during npm installs as temporary mitigations.
Description
The easypanel-hosting npm package version 1.0.0 contains malicious code that executes during installation. It collects sensitive environment metadata such as hostname, username, current working directory, and CI environment variables, encodes this data, and exfiltrates it via DNS and HTTP requests to an attacker-controlled domain. The main module is a stub, indicating the package is likely used for reconnaissance or dependency confusion attacks. This data leakage occurs automatically on npm install before any user code runs.
Impact
Sensitive environment information from the machine performing the npm install is leaked to an attacker-controlled domain. This includes hostname, username, working directory, and CI environment variables, which could aid attackers in reconnaissance and further attacks. The data exfiltration occurs without user interaction and before any legitimate code runs, potentially compromising the privacy and security of the build or deployment environment.
Summary
The easypanel-hosting package at version 1.0.0 includes a preinstall lifecycle script that gathers installer identity metadata including hostname, username, current working directory, and continuous integration environment variable names. This information is base64url-encoded and sent out-of-band via DNS queries and HTTP requests to a hardcoded subdomain under lyomeri.com. The main module exports an empty object, suggesting the package is a stub designed to probe or exploit dependency confusion. The exfiltration happens automatically during npm install, exposing sensitive environment details to an attacker-controlled server.