c2-client@1.0.0
Vulnerability report · Last retrieved from osv.dev September 24, 2026 at 3:58 PM UTC
OSV ID
MAL-2026-17165
Ecosystem
npm
Summary
The package name is 'c2-client' and package.json declares a postinstall hook that executes 'node setup.js' automatically on npm install. The setup script runs unattended in the installer's environment with the installer's privileges and network access. Combined with the package's self-declared C2-client purpose, install of this package is expected to establish an attacker-controlled command channel or execute attacker-controlled code on the installer's machine at install time.
Source: amazon-inspector (8c5e21fe48a0a1a03a1846e11cb06360950603c3bd8ccba5979c431c84779ba0)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.