OSV ID
MAL-2026-10957
Ecosystem
npm
Summary
iphouse@1.0.0 ships a postinstall.js lifecycle script that runs unconditionally on npm install . It collects installer host identifiers (hostname, platform, current working directory, node version, timestamp) and POSTs them as JSON to a hardcoded webhook.site endpoint (https://webhook.site/129cb2ee-ba08-4b3c-989c-270dc0030350) controlled by the package author. There is no opt-in, no disclosure to the installer, and no legitimate package functionality accompanying the beacon — the package's only behavior is host-metadata exfiltration to an anonymous author-controlled endpoint.
Source: amazon-inspector (70186abda59a78392fa403a58be7f3604692b279a7fdd625271b1e00bf53e7f2)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.