OSV ID
MAL-2026-11070
Ecosystem
npm
Summary
package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute __filename path (which typically embeds the OS username and directory layout), Node.js version, and platform/architecture to a hardcoded Discord webhook at discord.com/api/webhooks/1530599209269465319/. The destination is not caller-configurable, the behavior is undocumented, and the webhook URL literal is split via string concatenation to evade trivial grep for the full endpoint. The package ships no other functionality consistent with its name; the install-time beacon is the sole observable behavior.
Source: amazon-inspector (2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.