exiouss@5.0.1
Vulnerability report · Last retrieved from osv.dev September 30, 2026 at 7:13 AM UTC
OSV ID
MAL-2026-17327
Ecosystem
npm
Summary
main.js in exiouss@5.0.1 imports child_process and issues POST requests to hardcoded endpoints, including https://gemini.google.com and https://ipc.shadxino.internal (main.js around lines 368-386). The presence of an ipc.shadxino.internal destination alongside a public Google host, combined with child_process usage and repeated ping invocations across the file (lines 202, 340, 420, 583, 611), fits an active-exfiltration/reconnaissance shape rather than any documented HTTP-client behavior. The .internal host is not a resolvable public destination and its appearance in a published npm module is consistent with an attacker-side collector or a leaked internal C2 name.
Source: amazon-inspector (43ce408818d0222061c3b6ed499d77a245aae78e30e4f57c8e6e77ee52705805)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.