If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
ai-workshop-radio-lambda is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version (100.0.0) so it outranks private-registry versions, and runs `node setup.js || true` as a preinstall script on npm install. setup.js sends the hostname, username, working directory, OS, architecture, Node.js version and configured npm registry, with a per-package tracking token, in an HTTPS POST to `https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`. The npm account amel10 published ai-workshop-radio-lambda and 9 similar packages within two minutes on 2026-09-30, all with the same setup.js.
---
_-= Per source details. Do not edit below this line.=-_
Source: amazon-inspector (c626f28127d1b54e624e5dc670ae6a87aadcc7776de72d3597a16e9c0fa2b48f)
The package declares a `preinstall` lifecycle script (`node setup.js`) that runs automatically on `npm install`. setup.js collects installer-identifying data — `os.hostname()`, `os.userInfo().username`, `process.cwd()`, `process.platform`, `process.arch`, Node version, and the configured npm registry — and POSTs it together with a hardcoded static token to `https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`. The package's advertised functionality is a trivial add-two-numbers utility that has no legitimate need for host reconnaissance or outbound network activity at install time. The package name (`ai-workshop-radio-lambda`) and implausibly high version (`100.0.0`) are consistent with a dependency-confusion lure designed to win resolution against an internal package of the same name.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- s85r5k14qk[.]execute-api[.]us-east-1[.]amazonaws[.]com other packages →
URLs
- hxxps://s85r5k14qk[.]execute-api[.]us-east-1[.]amazonaws[.]com/prod/hook other packages →