MAL-2026-16297 Malicious code in keroeltop (npm)

[email protected] is a lure package whose index.js runs on every npm lifecycle phase (preinstall/install/postinstall/prepare) and issues an HTTP request to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/<packages>?h=<hostname>, transmitting the installer's os.hostname() to an attacker-controlled Pipedream webhook. The version number 99.99.99 is the canonical dependency-confusion resolution-winning shape used to override an internal package name. The package additionally declares a dependency on requests@^0.3.0 (an npm name resembling request) and requires it at the top of index.js, causing whatever bytes resolve for that name to be fetched and loaded transitively at install time. No legitimate functionality is present.

The OpenSSF Package Analysis project identified 'keroeltop' @ 99.99.99 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.