service-roles-registry (npm): malicious preinstall script exfiltrates host identifiers via dependency-confusion lure
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
A malicious npm package, service-roles-registry@99.0.2, was published to the public registry and flagged by Amazon Inspector via the OpenSSF malicious-packages project. The package runs index.js as a preinstall script that collects os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to a hardcoded Pipedream endpoint (eog6t9e6egptozp.m.pipedream.net). The version number and name shape indicate a dependency-confusion lure designed to win resolution against an internal package of the same name, so any developer or CI build that installs it silently leaks host identifiers to a third-party collector. There is no patched version; the fix is to remove and block the package.
What to do
- Audit lockfiles and CI logs for any install of service-roles-registry@99.0.2; treat affected build hosts' hostname, username, and cwd as disclosed
- Remove the package from dependencies and lockfiles; purge npm cache
- Block the package name and the pipedream.net endpoint at the registry proxy and egress firewall
- Enable dependency-confusion protections: scoped registry mappings, allowlists, and --ignore-scripts for untrusted installs
- Rotate credentials accessible from affected build machines if exposure is confirmed
Sources
All live incidents on Threat Watch
