@lekzo_dev/amprem@1.0.4
Vulnerability report · Last retrieved from osv.dev October 13, 2026 at 1:59 PM UTC
OSV ID
MAL-2026-17813
Ecosystem
npm
Summary
Package presents itself as an 'Alight Motion Premium Activator' and exposes an API that POSTs caller-supplied email addresses and 'magic link' authentication URLs to the hardcoded endpoint https://charge-omissions-bits-prerequisite.trycloudflare.com/api/verify. Magic-link URLs are single-use login credentials; forwarding them to a third-party ephemeral trycloudflare.com tunnel gives the operator of that tunnel the ability to consume the link and authenticate as the caller's account. The destination host has no relationship to Alight Motion's real infrastructure and is not the package's declared homepage (amprem-swart.vercel.app). The hardcoded, non-first-party, ephemeral-tunnel destination combined with the credential-grade payload constitutes account-takeover-capable credential exfiltration.
Source: amazon-inspector (ec2a03e817ffe43fd777ac600302898da7b30ad7653e1c57bea618e9801dba3b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.