MAL-2026-16072 Malicious code in easypanel-agent (npm)

The package's preinstall lifecycle script (preinstall.js) executes automatically on npm install and collects the installer's hostname, OS username, current working directory, and CI-related environment variable names. The collected data is base64-encoded and transmitted to a hardcoded out-of-band collector under lyomeri.com via both a DNS lookup (encoding data into a subdomain label under easypanel-agent.<data>.oob.lyomeri.com) and an HTTP GET request to the same host. The package's main entry, index.js, is an empty stub (module.exports = {}), so the install-time beacon is the sole functional behavior. The package name mimics the 'easypanel' product, consistent with a dependency-confusion or typosquat delivery vehicle. An in-source comment self-labeling the code as a 'benign canary' does not change that installer-controlled data leaves the machine without consent to an author-controlled endpoint.