{"id":"GHSA-qvhq-m873-hq8g","aliases":[],"status":"published","title":"Malicious code in service-roles-registry (npm)","description":"## Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0)\nservice-roles-registry@99.0.2 runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.\n\n---\n\nCredit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e42d117776998fa48d6eb4956bfaba9e434b902b/osv/malicious/npm/service-roles-registry/MAL-2026-18519.json))","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-506"],"published":"2026-11-03T09:31:45Z","modified":"2026-11-04T06:32:52Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"service-roles-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"99.0.2"},{"last_affected":"99.0.2"}]}],"versions":["99.0.2"]},{"source":"ghsa","ecosystem":"npm","package":"service-roles-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"99.0.1"},{"last_affected":"99.0.1"}]}],"versions":["99.0.1"]}],"references":[{"url":"https://github.com/ossf/malicious-packages/blob/e42d117776998fa48d6eb4956bfaba9e434b902b/osv/malicious/npm/service-roles-registry/MAL-2026-18519.json"},{"url":"https://www.npmjs.com/package/service-roles-registry/v/99.0.2"},{"url":"https://github.com/ossf/malicious-packages/blob/46f3617ed44a560ec03be9059e055445dbe56652/osv/malicious/npm/service-roles-registry/MAL-2026-18519.json"},{"url":"https://github.com/advisories/GHSA-qvhq-m873-hq8g"}],"sources":{"ghsa":[{"id":"GHSA-qvhq-m873-hq8g","title":"Malicious code in service-roles-registry (npm)","description":"## Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0)\nservice-roles-registry@99.0.2 runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.\n\n---\n\nCredit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e42d117776998fa48d6eb4956bfaba9e434b902b/osv/malicious/npm/service-roles-registry/MAL-2026-18519.json))","status":"published","published":"2026-11-03T09:31:45Z","modified":"2026-11-04T06:32:52Z","cwes":["CWE-506"],"updated_at":"2026-11-04T06:56:59.793788Z"}]}}