rendezvous-js (npm) · Malicious Code
Affects rendezvous-jsSource GCVE Database
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmrendezvous-js | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package rendezvous-js version 9.9.11 contains malicious code that exfiltrates host identity information via DNS queries during installation and module import. It collects the username, hostname, and current working directory, encoding this data into DNS A-record lookups to an attacker-controlled domain, bypassing typical network filtering. The package's README falsely claims no network or file system access, misleading users. This behavior indicates a supply chain attack through a typosquatting or dependency confusion tactic. Systems with this package installed should be considered compromised.