The package is marked as malware by OSV: MAL-2026-2612 with source: ghsa-malware

Note: This report is updated by a verification record

The package contains a postinstall.js script that exhibits multiple malicious behaviors. It collects sensitive system information, including environment variables, SSH keys, AWS credentials, Docker configurations, and the output of various system commands. This data is then exfiltrated to a remote server (p1s.uk) using HTTP/HTTPS POST requests. The script also accesses shell histories and GCP credentials. Multiple YARA rules confirm these behaviors, including user_sys_net_disk_recon, id_rsa_not_ssh, bash_history_high, zsh_history, nodejs_sysinfoexfil, nodejs_phone_home, gcp_ssh_credentials, linux_server_stealer, curl_https_ssh, and exfil_whoami_hostname. LLM analysis further confirms data exfiltration, environment variable harvesting, file content reading and exfiltration, and command execution with output exfiltration. The presence of a postinstall script executing arbitrary code adds to the suspicion.