Fake React UI helper that steals your whole environment on install
The npm package [email protected] advertises itself as a "Small UI banner helper for React apps" — a decoy. Its real payload is a postinstall hook that runs the moment you npm install, before any of your code. It fingerprints the host (os.hostname(), process.cwd(), os.userInfo()), collects the entire process.env — every secret, token and CI credential in the environment — and POSTs all of it to a webhook.site out-of-band endpoint. Not a benign install-beacon: it exfiltrates the full environment. Still live on npm; also in OSV as MAL-2026-10099.
The npm package polipoli-pak (version 1.0.2, published 2026-07-09) presents itself as a "Small UI banner helper for React apps". That description is a decoy; the package's purpose is an install-time environment stealer.
Its package.json declares postinstall: node postinstall.js, so the payload runs automatically on npm install, before the package is ever imported — including in CI, containers and developer machines.
codelake surfaced it from the live npm feed via its install-hook dropper pipeline; the reconstructed exfil URL and the whole-environment collection are the decisive signals. It is also catalogued in OSV (MAL-2026-10099), which we cite as independent corroboration.
1 · Host + user fingerprint. Reads os.hostname(), process.cwd() and os.userInfo() to tag the victim machine.
2 · Full environment harvest. Collects the entire process.env — every environment variable, i.e. every secret, API token, cloud credential and CI variable present at install time.
3 · Exfiltration to webhook.site. The collected data is JSON.stringify-packaged and POSTed to https://webhook.site/a428f027-90c9-45e2-acca-ffbb4ea86044 — a webhook.site request-capture endpoint used as an out-of-band exfil channel (the assembled URL is why our deobfuscation engine flagged it). All error paths are swallowed so the install looks normal.
Not a benign beacon. Some dependency-confusion probes only ping a callback with a hostname; this one sends the full process.env — that is credential exfiltration, not reconnaissance.
Detected + classified independently by codelake Research via its install-hook dropper-hunting pipeline · deterministic structural analysis of the packed tarball (package.json hook, postinstall control flow, assembled exfil URL). Independently corroborated by OSV (MAL-2026-10099); an npm takedown report has been filed.
This is a confirmed-malware advisory. No working payload or reproduction is published — the behaviour is described from structural analysis, and the webhook.site exfil endpoint is named as a defensive indicator only. The original artifact is preserved in the codelake archive and available to verified security researchers on request.