MAL-2026-15812 Malicious code in eslint-rxjs (npm)

eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate redis with cookies', and the author field impersonates well-known maintainers. The package ships no advertised functionality; index.cjs contains only a beacon helper. The package.json postinstall hook runs scripts/postinstall.cjs, which loads index.cjs and calls onInstall(), unconditionally issuing an HTTP GET to the hardcoded ngrok tunnel https://e493-95-216-46-122.ngrok-free.app/ping at install time. An ngrok-free.app subdomain is ephemeral, attacker-controlled infrastructure with no legitimate use for a published package; the request confirms code execution on the installer's machine and discloses the installer's source IP and install timing to that endpoint. This is the reconnaissance stage of a supply-chain dropper.

The OpenSSF Package Analysis project identified 'eslint-rxjs' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.