Malicious Code Vulnerability in keroeltopgg Package
Summary
MAL-2026-16334: Malicious code in keroeltopgg (npm). Affects keroeltopgg versions 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The keroeltopgg package is an npm package designed as a stub with no real functionality. It contains an empty description, lacks a README, and has a version number set to 99.99.99, which is often associated with dependency confusion attacks. The package's main file, index.js, executes code that sends sensitive information to an external server, making it a potential risk for users.
Vulnerability Detail
The vulnerability originates from the keroeltopgg package, which executes malicious code upon being required or imported. This code retrieves the hostname of the user's operating system and sends it, along with the package name, to a hardcoded external endpoint. This behavior can lead to data leakage, as it exposes the installer's hostname to the package's author, potentially allowing for targeted attacks or further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall keroeltopggIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can monitor your dependencies using tools like Vulert, which can alert you to vulnerabilities in your open-source packages. You can also use the Vulert playground at https://vulert.com/scanner to check if your application is affected by this vulnerability without requiring any signup.
Conclusion
The keroeltopgg package poses a significant risk due to its malicious code that leaks sensitive information. Users are advised to remove this package from their projects and utilize tools like Vulert for ongoing monitoring of their dependencies.
See every vulnerability recorded for keroeltopgg →
FAQ
keroeltopgg is an npm package that serves no real functionality and is primarily a stub package with malicious intent.
The vulnerability manifests when the package is imported, executing code that sends the user's hostname to an external server.
The risks include data leakage of the user's hostname, which could lead to targeted attacks or further exploitation.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without signing up.
If you have the keroeltopgg package installed, you should uninstall it immediately using the command 'npm uninstall keroeltopgg'.
