MAL-2026-11069

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4fd8aaf2fc6ca964eed6950b6868486125905bacabe6b8bb1cbd581bb6a59f4c)

clerk-next-fix-auth-protection@8.8.8 is a typosquat of Clerk/Next.js auth tooling that ships no functional code (declared main index.js is absent from the tarball). Both preinstall and postinstall lifecycle hooks in package.json run a plain-HTTP curl to http://u3ukeehm.requestrepo.com/depconf/clerk-next-fix-auth-protection/ with the installer's username (whoami), hostname, current working directory, and timestamp embedded in the query string. The beacon fires unconditionally on npm install, targets an anonymous requestrepo.com subdomain, and constitutes a dependency-confusion/typosquat reconnaissance probe that exfiltrates installer identity to an attacker-controlled endpoint.

Source: ossf-package-analysis (11ae257db932f3501d4f9168d9fb3c7abbdb1c6dad37f5bab183785662b3d9b6)

The OpenSSF Package Analysis project identified 'clerk-next-fix-auth-protection' @ 8.8.8 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.