Is service-roles-registry malicious?
Yes. Protet confirmed 1 version of service-roles-registry as malicious
First confirmed on 2026-11-02.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 99.0.2 | 2026-11-02 | PROTET-NPM-2026-159 |
What it does
A dependency-confusion package published 2026-11-02 under an internal-looking name with an inflated 99.x version to win resolution over a private package. Version 99.0.2 ships a preinstall hook ('node index.js') that runs on 'npm install'; index.js reads the machine identity (os.hostname, os.userInfo) and the working directory and sends them by HTTPS POST to a public request-collection endpoint. Self-described as a dependency-confusion proof of concept. The earlier 0.0.0-stage and 99.0.1 versions ship no install hook. SHA-256 of the 99.0.2 index.js: ca719dd4b07aeddffaf59facde11726e981bad6d15620b47407f943ea00bb496.
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-11-02: 99.0.2 named by Protet Intel