Malicious Code Exposure in rs-lookout-sandbox-poc Package
Summary
MAL-2026-18109: Malicious code in rs-lookout-sandbox-poc (npm). Affects rs-lookout-sandbox-poc versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rs-lookout-sandbox-poc package is an npm module designed for sandboxing and testing purposes. It allows developers to create isolated environments for running code securely. However, this package has been found to contain malicious code that compromises user data and security.
Vulnerability Detail
The vulnerability originates from the package's index.js file, which automatically reads the local username using os.userInfo().username and sends it to a hardcoded external collector at webhook.site. Additionally, it performs reconnaissance on AWS Instance Metadata Service, potentially exposing sensitive IAM role information. This behavior occurs without any action from the user, making it a severe security risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rs-lookout-sandbox-pocIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the rs-lookout-sandbox-poc package until a fixed version is released. If you must use it, consider isolating it in a controlled environment where it cannot access sensitive data or external networks.
Conclusion
The rs-lookout-sandbox-poc package contains a significant vulnerability that exposes user data and AWS metadata. It is crucial to update to a patched version or implement workarounds to mitigate risks. Regularly monitoring your dependencies with tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for rs-lookout-sandbox-poc →
FAQ
It is an npm module designed for creating isolated environments for testing code securely.
The package sends the local username to an external endpoint and performs reconnaissance on AWS metadata, potentially exposing sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Check the package repository for any updates or patched versions of the rs-lookout-sandbox-poc package.
As a workaround, avoid using the package or isolate it in a controlled environment to minimize risk.
