Malicious code in golan125-homepage-test (npm)
MAL-2026-10897 · GHSA-6p3c-6jvh-3pg8
Published · Modified
Dependency scanning
Check whether golan125-homepage-test is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (705b0dc2e3b9aafb6d0e72ecb5ad51d873cd59104a045f74bb27161c87a24960)
Package self-identifies as a security research test ('Security research test - do not install'). The package.json homepage field contains javascript:alert(document.domain), which is an XSS probe targeting any registry or UI frontend that renders homepage values as clickable links without sanitization. The package has no lifecycle scripts (no preinstall/install/postinstall), no network I/O, and index.js exports an empty object — installing or requiring this package does not harm the installer's machine. The XSS probe targets registry web UI rendering, not developers who install the package.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes