Malicious Code Vulnerability in @s4yhiitestpoc/r2-https-b Package
Summary
MAL-2026-17808: Malicious code in @s4yhiitestpoc/r2-https-b (npm). Affects @s4yhiitestpoc/r2-https-b versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @s4yhiitestpoc/r2-https-b package is an npm package that is intended for use in various JavaScript applications. It is designed to facilitate HTTPS requests. However, it has been found to contain malicious code that compromises user data and privacy. This vulnerability poses a significant risk to users who install this package, as it collects sensitive information without consent.
Vulnerability Detail
The vulnerability originates from the postinstall.js script within the package, which automatically collects sensitive installer-side data such as hostname, username, home directory, network interface addresses, DNS servers, and the internal npm registry URL. This data is then sent to a hardcoded endpoint controlled by the package author. The dual-channel data collection mechanism, which includes a DNS lookup to a unique subdomain, allows the attacker to bypass outbound HTTPS restrictions, making it a serious security threat. The behavior of this package aligns with known patterns of dependency-confusion attacks, where malicious code is disguised as a legitimate package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @s4yhiitestpoc/r2-https-bIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the @s4yhiitestpoc/r2-https-b package altogether and look for alternative packages that provide similar functionality without the associated risks.
Conclusion
The @s4yhiitestpoc/r2-https-b package contains malicious code that compromises user data. It is crucial to uninstall this package immediately and monitor for any updates or patches. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for @s4yhiitestpoc/r2-https-b →
FAQ
The main risk is that it collects sensitive user data and sends it to an attacker-controlled server without user consent.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
You should uninstall the package immediately using 'npm uninstall @s4yhiitestpoc/r2-https-b' and look for alternative packages.
Currently, there is no mention of a patched version. It is advisable to remove the package until a secure version is released.
The postinstall.js script collects various installer-side data and sends it to a hardcoded endpoint, posing a significant security risk.
