MAL-2026-18519: Malicious code in service-roles-registry (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0) service-roles-registry@99.0.2 runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.
Affected Software
Event History
Frequently Asked Questions
Who is most likely to be exposed to this package?
Organizations with an internal package named service-roles-registry are the most likely targets, because version 99.0.2 appears designed as a dependency-confusion lure. Developer workstations and CI/build systems are exposed if npm resolves and installs this public package.
What must happen for data to be transmitted?
The package must be installed through npm. Its preinstall script runs index.js during installation and sends collected data over HTTPS to a hardcoded third-party endpoint.
What information is sent from an affected machine?
The script collects the hostname, current OS username, current working directory, and package metadata. It POSTs this information to https://eog6t9e6egptozp.m.pipedream.net.
How can teams determine whether they were affected?
Check dependency manifests, lockfiles, npm cache or installation logs, and build records for service-roles-registry version 99.0.2. Systems or builds that installed that version should be treated as having transmitted the listed host and package information.