easypanel-hosting@1.0.0
Malicious code in easypanel-hosting (npm)
Analysis
The preinstall hook (preinstall.js) runs on install and silently collects the installer's hostname, username, current working directory, and the names of CI/CD environment variables (GITHUB_, GITLAB_, BUILD_, JENKINS, CIRCLE, TF_BUILD, BITBUCKET, DRONE, AWS_CODEBUILD). This data is base64url-encoded and exfiltrated to the remote host easypanel-hosting[.]daco3v4q6f49egu1ds1gwjnsjb88s5kcp[.]oob[.]lyomeri[.]com via both a DNS lookup and an HTTP request to /npm/<encoded-data>. The hook always exits 0 so the build is not broken and the exfiltration is not noticed.
- analyzed by
- Leitwacht
- first seen
- Sep 3, 2026, 06:02 PM
- analyzed
- Sep 3, 2026, 06:03 PM
Related advisories
- easypanel-deploy@1.0.0
- easypanel-cli@1.0.0
- fieldbase-webapplication-buildtools@99.99.99
- @quantixfinance/database@1.0.1
- @quantixfinance/token@1.0.1
- @quantixfinance/contracts@1.0.0
- @quantixfinance/wallet@1.0.0
- @quantixfinance/common@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.