1239i32049i @0.1.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12117
Ecosystem
npm
Summary
Package declares a postinstall script that runs dist/index.js, the sole shipped file, which is heavily obfuscated with javascript-obfuscator (rotated string array, _0xNNNN identifiers, control-flow dispatch). At install time it reads process.env.P, issues an HTTPS GET to https://dropper-crm.vercel.app/api/payload/<P>, base64-decodes the response body, and executes it via new Function('require', decoded), granting the remote endpoint arbitrary code execution with require access on the installing machine. The package name is a numeric string with no documented functionality, no README, and no legitimate purpose beyond delivery of the remote payload.
Source: amazon-inspector (6c99f6d077df7b1209fb59dafa8641b14b3947d321379bc6ad22f2660d3d4c7b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.