rpc-endpoint-rotator @1.0.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12431
Ecosystem
npm
Summary
index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname, username, and home directory. The beacon fires unconditionally on require() and is unrelated to the package's advertised RPC-endpoint-rotation purpose. Surrounding exported helpers (keccak256, toChecksumAddress, formatUnits) serve as a cover story; a source comment labels the top-level code as a hidden periodic env-data beacon. Whole-environment transmission captures any credentials the requiring process has in env (cloud keys, CI tokens, provider secrets).
Source: amazon-inspector (7eda47a0d1da23b08d63a5fa4339234b9a19bc7aedf7b74d060731b24841be2a)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.