keroeltopgg@99.99.99
Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 7:43 AM UTC
OSV ID
MAL-2026-16334
Ecosystem
npm
Summary
keroeltopgg@99.99.99 is a stub package whose index.js, executed on require/import, reads os.hostname() and issues an HTTPS GET to the hardcoded collector https://eo8f3m3ho26a0nm.m.pipedream.net/ with the package name and hostname as query parameters. The manifest has no real functionality: empty description, no README, version 99.99.99 (the canonical dependency-confusion probe version), duplicate 'Dependencies'/'dependencies' keys, and lifecycle scripts that only echo marker strings. The sole runtime behavior is the outbound beacon to an author-controlled Pipedream endpoint, which reports successful internal-namespace resolution and leaks the installer's hostname to the operator.
Source: amazon-inspector (52b4e331f9f02f436e01e5c7696088d12ea3237af7fbe54fd37ec37e786c960d)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.