If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199)
keroeltop@99.99.99 is a lure package whose index.js runs on every npm lifecycle phase (preinstall/install/postinstall/prepare) and issues an HTTP request to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/<packages>?h=<hostname>, transmitting the installer's os.hostname() to an attacker-controlled Pipedream webhook. The version number 99.99.99 is the canonical dependency-confusion resolution-winning shape used to override an internal package name. The package additionally declares a dependency on `requests@^0.3.0` (an npm name resembling `request`) and requires it at the top of index.js, causing whatever bytes resolve for that name to be fetched and loaded transitively at install time. No legitimate functionality is present.
Source: ossf-package-analysis (89aae084914d96e7e7620a79371083c4e1bb4a838fac1633aff257c5a380eab8)
The OpenSSF Package Analysis project identified 'keroeltop' @ 99.99.99 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.