r17d-sec-research-marker (npm): postinstall script exfiltrates host metadata and credential-path inventory to webhook.site
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
The npm package r17d-sec-research-marker@1.0.0 contains malicious code flagged by Amazon Inspector and catalogued by OpenSSF/GitHub as malware (GHSA-7g8r-g568-m7rv, CWE-506). Its postinstall script (collect.js) performs host reconnaissance on install: runs whoami, OS/kernel info, lists the home directory and cwd, probes for credential/config files (~/.npmrc, ~/.gitconfig, ~/.config/gh, ~/.novus), and enumerates all process.env variable names, then POSTs the collected JSON to a hardcoded anonymous webhook.site endpoint. The data reveals CI provider, cloud credential presence and secret-store usage, enabling follow-on credential targeting. The package self-labels as a 'security research POC collecting metadata only', but the installer did not opt in and the destination is an anonymous third-party collector. No patched version exists; the package should be treated as malware and removed.
What to do
- Check whether r17d-sec-research-marker@1.0.0 is present in any dependency tree or lockfile and remove it immediately
- If installed, treat the build machine's environment and credential files as exposed: rotate npm tokens, GitHub/Git credentials, and any cloud or CI secrets that were present
- Review CI and developer machines that ran npm install since the package's publication for the exfiltration behavior and any follow-on access
- Block outbound requests to webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61 in build environments
- Audit npm install pipelines with --ignore-scripts where feasible and monitor for similar metadata-exfiltration postinstall scripts
Sources
All live incidents on Threat Watch
