MalwarePublished 8 Jul 2026Updated 20 Jul 2026

next-locomotive-init (npm) · Malicious Code

Affects next-locomotive-initSource GCVE Database

Malicious package : remove next-locomotive-init and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-7013

What to do

Remove next-locomotive-init from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnext-locomotive-init	Affected 1.0.0 – 1.0.4 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9a11400eaa7dd74b24610ec815438de047089be7005b94c37717fa2b6f916ab6) The package's declared postinstall script reads the installer's OS username via os.userInfo().username and the machine hostname via os.hostname(), composes them into a `<username>@<hostname>` identifier, and POSTs them to a hardcoded remote endpoint at https://seedance2-api.vercel.app/api/agent/register together with a `source: 'next-locomotive-init'` tag. The package is advertised as animation utilities for Next.js templates; there is no functional or documented reason to transmit host identifiers to a third-party endpoint on install. The transmission fires automatically as a lifecycle script on `npm install` with no opt-in, no configuration, and no disclosure, giving the operator of that endpoint a census of every machine that installs the package — a beacon consistent with reconnaissance for follow-on targeting.

Impact

The impact is the unauthorized exfiltration of host identifiers (username and hostname) from machines installing the affected package versions. This leakage of environment-specific information can facilitate attacker reconnaissance and profiling of victims. There is no indication of further exploitation or payload delivery within the package itself. No known exploits in the wild have been reported.

Defensive guidance

Users should avoid installing the affected versions (=1.0.0, =1.0.1, =1.0.2, =1.0.3, =1.0.4) of next-locomotive-init. If already installed, remove the package and consider scanning for other malicious dependencies. Monitor vendor advisories or repository updates for any official fixes or guidance. Since this is not a cloud service, remediation depends on user action.

Summary

The next-locomotive-init npm package versions 1.0.0 through 1.0.4 include a malicious postinstall lifecycle script. This script uses Node.js os.userInfo().username and os.hostname() to gather the local machine's username and hostname, concatenates them into a <username>@<hostname> string, and sends this data via an HTTP POST request to a hardcoded external URL (https://seedance2-api.vercel.app/api/agent/register) with a source tag identifying the package. This data exfiltration occurs silently with no opt-in or notification, potentially enabling the remote operator to build a census of machines installing the package, which is consistent with reconnaissance activity for further targeting.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 09:56 UTC

Technical details

References

Community reviews