Note: This report is updated by a verification record
Package is malware. It collects and exfiltrates sensitive data (SSH keys, credentials, environment variables) and system info to a remote server.
The package is marked as malware by OSV: MAL-2026-2614 with source: ghsa-malware
Note: This report is updated by a verification record
The package exhibits multiple indicators of malicious behavior. The postinstall.js script collects sensitive information including SSH keys, shell history, AWS/GCP credentials, and environment variables. It executes system commands to gather system and network information. All of this data is then exfiltrated to a remote server (p1s.uk) via HTTP(S). Multiple YARA rules such as user_sys_net_disk_recon, nodejs_sysinfoexfil, nodejs_phone_home, id_rsa_not_ssh, bash_history_high, zsh_history, gcp_ssh_credentials, linux_server_stealer, curl_https_ssh, and exfil_whoami_hostname match the behavior of the postinstall.js file. The LLM based file evaluation service also confirms the sensitive file exposure, command execution, and data exfiltration. These pieces of evidence, taken together, strongly suggest that this package is malicious.
