MAL-2026-18519

service-roles-registry runs code during npm install that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint:

• 99.0.2 (published 2026-11-02 17:53 UTC): its preinstall script is node index.js, which npm runs during npm install. In index.js (SHA-256 ca719dd4b07aeddffaf59facde11726e981bad6d15620b47407f943ea00bb496), lines 9-15 contain a request address on a public request-collection service, https://eog6t9e6egptozp.m.pipedream.net (line 15), a read of the machine's identity, os.hostname() (line 9), a read of the machine's identity, os.userInfo() (line 10) and a network request call, https.request( (line 15).

The code is quoted from the published archive.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0)

service-roles-registry@99.0.2 runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.