{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "service-roles-registry"
   },
   "versions": [
    "99.0.2"
   ]
  }
 ],
 "aliases": [],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/service-roles-registry/99.0.2"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "A dependency-confusion package published 2026-11-02 under an internal-looking name with an inflated 99.x version to win resolution over a private package. Version 99.0.2 ships a preinstall hook ('node index.js') that runs on 'npm install'; index.js reads the machine identity (os.hostname, os.userInfo) and the working directory and sends them by HTTPS POST to a public request-collection endpoint. Self-described as a dependency-confusion proof of concept. The earlier 0.0.0-stage and 99.0.1 versions ship no install hook. SHA-256 of the 99.0.2 index.js: ca719dd4b07aeddffaf59facde11726e981bad6d15620b47407f943ea00bb496.",
 "id": "PROTET-NPM-2026-159",
 "modified": "2026-11-02T18:39:03Z",
 "published": "2026-11-02T18:39:03Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/service-roles-registry/99.0.2"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Malicious code in service-roles-registry (npm)"
}