Malicious code in @openrepl/shared (npm)

The npm package @openrepl/shared was distributed with malicious code embedded in its preinstall hook. The package.json declared a node index.js preinstall script that automatically executed during npm install.\n\nThe index.js file used Node.js child_process to execute a curl command that sent a POST request to https://youjoex.free.beeceptor.com/$(whoami)/$(hostname). This command embedded the installer's OS username and hostname (via shell command substitution) directly into the URL path, exfiltrating this information to beeceptor.com, a public request-inspection service commonly used for low-effort data exfiltration.\n\nThe package advertised no legitimate functionality and contained no library code consistent with its "shared" name, indicating it was created solely for malicious purposes. The incident was identified and credited to the OpenSSF's malicious-packages repository.\n\nThe package has been removed from npm and the incident is considered resolved.