service-roles-registry

GHSA-qvhq-m873-hq8g

Malicious code in service-roles-registry (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.0.2`

## Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0)
[email protected] runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e42d117776998fa48d6eb4956bfaba9e434b902b/osv/malicious/npm/service-roles-registry/MAL-2026-18519.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e42d117776998fa48d6eb4956bfaba9e434b902b/osv/malicious/npm/service-roles-registry/MAL-2026-18519.json
- https://www.npmjs.com/package/service-roles-registry/v/99.0.2
- https://github.com/ossf/malicious-packages/blob/46f3617ed44a560ec03be9059e055445dbe56652/osv/malicious/npm/service-roles-registry/MAL-2026-18519.json
- https://github.com/advisories/GHSA-qvhq-m873-hq8g

Compromised versions (1)

= 99.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.