Malicious code in ksp-client-registry (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3b11a639f5149e4b1c17e64eb78f226abece5ed03152b5933333a3cb56284018) The npm package [email protected] ships a prebuilt native addon at prebuilds/linux-x64/addon.node that is loaded by the package main (index.js require of./prebuilds/linux-x64/addon). On load the addon reads the HOSTNAME, npm_package_name, and npm_config_registry environment variables and opens a raw TCP socket to the hardcoded IP 64.181.165.115, sending them in an HTTP request of the form 'POST /dc HTTP/1.0' with a body shaped as 'h=<hostname>&p=<package>&u=<user>&r=<registry>'. ELF strings corroborate the behavior: '64.181.165.115', 'POST /dc HTTP/1.0', 'Host: 64.181.165.115', 'HOSTNAME', 'npm_package_name', 'npm_config_registry', and imports of socket/connect/send/fork/getenv/inet_pton. package.json declares a postinstall ('node postinstall.js') providing an install-time footprint, and any require() of the package triggers the beacon regardless. The addon exposes no legitimate N-API functionality beyond module registration. The implausibly high version (100.100.100) and generic registry-style name are consistent with a dependency-confusion probe designed to be resolved in place of an internal package and to report back the victim host, internal package name, and configured registry URL to the operator.

Source published

11 Oct 2026 13:56:54 UTC

Source modified

11 Oct 2026 14:30:09 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.