What does the service-roles-registry malware do?

service-roles-registry runs code during `npm install` that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint: - 99.0.2 (published 2026-11-02 17:53 UTC): its `preinstall` script is `node index.js`, which npm runs during `npm install`. In `index.js` (SHA-256 `ca719dd4b07aeddffaf59facde11726e981bad6d15620b47407f943ea00bb496`), lines 9-15 contain a request address on a public request-collection service, `https://eog6t9e6egptozp.m.pipedream.net` (line 15), a read of the machine's identity, `os.hostname()` (line 9), a read of the machine's identity, `os.userInfo()` (line 10) and a network request call, `https.reques

Which versions of service-roles-registry are malicious?

The following npm versions of service-roles-registry are flagged malicious: 99.0.1, 99.0.2. Treat any of these as compromised.

How do I remediate service-roles-registry if I installed it?

service-roles-registry is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed service-roles-registry — how do I know if it already compromised me?

If service-roles-registry was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is service-roles-registry part of a known attack campaign?

Yes — service-roles-registry is associated with the IN-MAL-2026-022531 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find service-roles-registry across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for service-roles-registry (2 malicious versions).

Malicious package

service-roles-registrynpm

Advisory published Nov 2, 2026Updated Nov 4, 2026

service-roles-registry is a confirmed malicious npm package (MAL-2026-18519) that steals credentials and exfiltrates sensitive data (malicious versions 99.0.1, 99.0.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in service-roles-registry (npm)

MAL-2026-18519

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall service-roles-registry

What this malware does

service-roles-registry runs code during npm install that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint:

99.0.2 (published 2026-11-02 17:53 UTC): its preinstall script is node index.js, which npm runs during npm install. In index.js (SHA-256 ca719dd4b07aeddffaf59facde11726e981bad6d15620b47407f943ea00bb496), lines 9-15 contain a request address on a public request-collection service, https://eog6t9e6egptozp.m.pipedream.net (line 15), a read of the machine's identity, os.hostname() (line 9), a read of the machine's identity, os.userInfo() (line 10) and a network request call, https.request( (line 15).

The code is quoted from the published archive.

[email protected] runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.

Malicious versions

2 flagged

99.0.199.0.2

Indicators of compromise (SHA-256)

4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for service-roles-registry (2 malicious versions).
If you installed it — respond
service-roles-registry is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If service-roles-registry was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. service-roles-registry on npm has been identified as a malicious package (versions 99.0.1, 99.0.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-022531

References

npmjs.com

Credits

Amazon Inspector · finder
InvisiRisk, Inc. · finder
Linus Baumberger (Gatekeeper) · finder

Detect & block this

O3 blocks service-roles-registry-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database