service-roles-registry

Details

service-roles-registry runs code during `npm install` that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint:

- 99.0.2 (published 2026-11-02 17:53 UTC): its `preinstall` script is `node index.js`, which npm runs during `npm install`. In `index.js` (SHA-256 `ca719dd4b07aeddffaf59facde11726e981bad6d15620b47407f943ea00bb496`), lines 9-15 contain a request address on a public request-collection service, `https://eog6t9e6egptozp.m.pipedream.net` (line 15), a read of the machine's identity, `os.hostname()` (line 9), a read of the machine's identity, `os.userInfo()` (line 10) and a network request call, `https.request(` (line 15).

The code is quoted from the published archive.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0)
[email protected] runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.

Compromised versions (2)

• 99.0.2
• 99.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.