claude-channel-discord@9.9.9
Vulnerability report · Last retrieved from osv.dev September 4, 2026 at 3:57 PM UTC
OSV ID
MAL-2026-15922
Ecosystem
npm
Summary
claude-channel-discord@9.9.9 is a dependency-confusion probe. package.json declares preinstall and postinstall hooks (node index.js --save-prod) and a main entry that both execute index.js, which reads os.hostname() and issues a GET to https://eo8f3m3ho26a0nm.m.pipedream.net/claude-channel-discord?h=${hostname}. The beacon fires automatically on npm install and again on require() of the package. The package has an empty description, an implausibly high 9.9.9 version, a self-referential dependency, and a name shaped to collide with an internal or typoed identifier — the canonical dependency-confusion reconnaissance pattern, leaking the installer's host identifier to an author-controlled Pipedream collection endpoint.
Source: amazon-inspector (40db25d41cbf34007ee5be9e31462d8346c3ec51dcb5b72160e76739aaedf4ad)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.