Protet

Protet Intel / npm / cs-core-api-phoenix

cs-core-api-phoenix 5.1.0

confirmed malicious PROTET-NPM-2026-6

Every version of this package that Protet Intel names: Is cs-core-api-phoenix malicious?

Details

The package runs node index.js from its postinstall script. The script sends an HTTPS POST request to https://nathanaccacio.com/collect with a JSON body holding the package name, the operating-system user name and the host name of the machine that installed it. It does nothing else.

Impact: the operator of nathanaccacio.com learns which users and hosts install the package.

Remediation: remove the package from all projects and lockfiles and review the hosts that installed it.

Indicators

Domainsnathanaccacio.com

URLshttps://nathanaccacio.com/collect

Shown as text on purpose; do not open them.

Records

Status history

  • 2026-10-22: named as a Protet finding

Want to know if your own builds pull packages like this? Add the Protet GitHub Action.

Think this is wrong? Write to hello@protet.io and we will look at it.