keroeltop@99.99.99
Vulnerability report · Last retrieved from osv.dev October 7, 2026 at 11:33 AM UTC
OSV ID
MAL-2026-16297
Ecosystem
npm
Summary
keroeltop@99.99.99 is a lure package whose index.js runs on every npm lifecycle phase (preinstall/install/postinstall/prepare) and issues an HTTP request to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/<packages>?h=<hostname>, transmitting the installer's os.hostname() to an attacker-controlled Pipedream webhook. The version number 99.99.99 is the canonical dependency-confusion resolution-winning shape used to override an internal package name. The package additionally declares a dependency on requests@^0.3.0 (an npm name resembling request) and requires it at the top of index.js, causing whatever bytes resolve for that name to be fetched and loaded transitively at install time. No legitimate functionality is present.
Source: amazon-inspector (0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.