notafollower1226 @1.0.5
Vulnerability report · Last retrieved from osv.dev August 15, 2026 at 10:37 PM UTC
OSV ID
MAL-2026-14036
Ecosystem
npm
Summary
The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint (ECS_CONTAINER_METADATA_URI_V4/task) to collect the Task ARN, container image list, and log group/stream configuration, then enumerates process.env for keys matching /owner|team|user|created|author|maintainer|contact/i, and pipes the resulting report via curl -X POST --data-binary @- to the hardcoded anonymous ngrok tunnel https://mourner-slot-explicit.ngrok-free.dev. The destination is not associated with any declared publisher and ngrok-free.dev subdomains are ephemeral anonymous tunnels typical of supply-chain reconnaissance against CI/build infrastructure. The package ships no other functionality consistent with a legitimate declared purpose; its only install-time effect is the exfiltration beacon.
Source: amazon-inspector (fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.