easypanel-ctl@1.0.0

Summary

On npm install, the preinstall lifecycle script collects installer host identity (hostname, username, cwd) and enumerates CI-related environment variable names, base64url-encodes the collected data, chunks it into DNS labels, and transmits it via both a DNS lookup and an HTTP GET to a hardcoded subdomain of oob.lyomeri.com (e.g. easypanel-ctl.<encoded-chunk>.oob.lyomeri.com, path /npm/<encoded>). The shipped module body is a stub (module.exports = {}), so the package has no legitimate runtime functionality; its only effect on install is the recon beacon. The destination is an out-of-band interaction domain unrelated to the easypanel.io publisher, and the encoding plus DNS-label chunking is a covert-channel exfiltration pattern. The name easypanel-ctl (with an empty stub body) is consistent with a dependency-confusion lure targeting installers of an internal or unrelated easypanel package.

Source: amazon-inspector (e9eb01006041231d7388c6aeb0c74288b35a8c72cf5b1e61c90e1e4f9d6d37c7)