discord-vibegrations-api-natives @1.0.5
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 1:58 AM UTC
OSV ID
MAL-2026-11537
Ecosystem
npm
Summary
On npm install, the package's postinstall.js opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes the socket's bytes into the stdin of a spawned sh process, with the shell's stdout/stderr piped back to the socket. The package.json declares "postinstall": "node postinstall.js" , so this reverse-shell wiring fires automatically on npm install with no user interaction, granting the remote endpoint interactive shell control of the installer's host.
Source: amazon-inspector (9cb64ecc29aa68ec4659bab280f4ffd2c3de889cc966c0974f85b0c488edc603)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.