test1df23@99.99.99
Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 7:43 AM UTC
OSV ID
MAL-2026-16312
Ecosystem
npm
Summary
package.json declares preinstall and postinstall hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP 128.199.122.145 over plain HTTP, with the package name embedded in the query string (http://128.199.122.145/?test1df23). The beacon fires automatically at install time, leaking the installer's outbound IP and confirming successful execution on the installer's host to the operator of that IP. The package name and near-empty payload are consistent with a dependency-confusion or typosquat probe.
Source: amazon-inspector (67708642854d76da722a8130de47a8fb7fd23f0035cf646f1bf16d97419e5756)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.