GHSA-qvhq-m873-hq8g
Malicious code in service-roles-registry (npm)
GHSA-qvhq-m873-hq8g is a vulnerability with no CVSS score yet in service-roles-registry, published November 3, 2026. No source lists public exploit code. No source names a fixed version.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0)
service-roles-registry@99.0.2 runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
service-roles-registrynpm | 99.0.2 to 99.0.2 | None known |
service-roles-registrynpm | 99.0.1 to 99.0.1 | None known |
What each source reports
GitHub AdvisoriesNo score
Malicious code in service-roles-registry (npm)
Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0)
service-roles-registry@99.0.2 runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.
- Record
GHSA-qvhq-m873-hq8g- Weakness
- CWE-506
- Updated
- 2026-11-04
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts, references | GitHub Advisories | |
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/ossf/malicious-packages/blob/e42d117776998fa48d6eb4956bfaba9e434b902b/osv/malicious/npm/service-roles-registry/MAL-2026-18519.json
npmjs.com/package/service-roles-registry/v/99.0.2