Logo
npm

easypanel-core@1.0.0

Vulnerability report · Last retrieved from osv.dev September 4, 2026 at 6:57 AM UTC

Malicious

OSV ID

MAL-2026-15897

Ecosystem

npm

Summary

easypanel-core ships an inert module.exports = {} main and places all functionality in a preinstall lifecycle script. On npm install, preinstall.js collects os.hostname(), os.userInfo().username, process.cwd(), and the names of CI-related environment variables, base64url-encodes them, and transmits the data to *.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com via both a DNS subdomain lookup and an HTTP GET to /npm/<encoded>. The package name mimics the easypanel project and the description advertises a 'client library', while the shipped library exports nothing and provides no functionality — the install-time beacon is the sole behavior.

Source: amazon-inspector (4cb013a465c19126feba2006a81f33d65cc64b269e3da8ffe4e8284c7defa3cc)

Protect your entire dependency tree

Scan your lock files automatically on every PR. Block malicious packages before they reach production.