Malicious code in functions-framework-nodejs (npm)

The npm package functions-framework-nodejs is a typosquat of Google's legitimate @google-cloud/functions-framework. Upon installation, the package's postinstall hook executes install.js, which runs execSync("id") to capture the installer's Unix user and group identity.

The captured identity information—including the package name, version, and timestamp—is then exfiltrated via HTTP POST to a hardcoded webhook.site collector URL controlled by the attacker. The package's advertised library surface (index.js) is a minimal stub that only exports the package name and version, making identity exfiltration its sole functional effect.

The package metadata falsely labels itself as "For Security Research" by author "Berserk," but this disclaimer does not prevent the malicious behavior. Any developer or automated system installing this package will have their host identity sent to a third-party endpoint without explicit configuration or consent.

This incident was identified and credited to the OpenSSF's malicious-packages repository.