easypanel-client@1.0.0
Malicious code in easypanel-client (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The preinstall hook (preinstall.js) runs on install and collects host metadata — hostname, username, current working directory, and the names of CI-related environment variables (CI, GITHUB_, GITLAB_, BUILD_, JENKINS, CIRCLE, TF_BUILD, BITBUCKET, DRONE, AWS_CODEBUILD) — then exfiltrates it to the out-of-band domain easypanel-client[.]daco3v4q6f49egu1ds1gwjnsjb88s5kcp[.]oob[.]lyomeri[.]com via both a DNS lookup and an HTTP request to /npm/<base64url-encoded-data>. The package name impersonates the easypanel self-hosted PaaS project.
- analyzed by
- Leitwacht
- first seen
- Sep 3, 2026, 06:02 PM
- analyzed
- Sep 3, 2026, 06:04 PM
Related advisories
- easypanel-docker@1.0.0
- easypanel-hosting@1.0.0
- easypanel-deploy@1.0.0
- easypanel-cli@1.0.0
- fieldbase-webapplication-buildtools@99.99.99
- @quantixfinance/database@1.0.1
- @quantixfinance/token@1.0.1
- @quantixfinance/contracts@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.