@azure-growth/signup-ux-components@1.2.3
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest activates the behavior during installation, and the source shows an automatic DNS disclosure of local identifiers to an unrelated OAST collector without a consent gate. This supports blocking as install-hook abuse.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package when npm runs its preinstall hook.
Impact
The OAST endpoint can receive identifying information about the installing user and machine.
Mechanism
index.js builds a DNS name containing the sanitized username and hostname, then calls dns.lookup on it without a consent check.
Attack narrative
During package installation, the preinstall hook runs index.js. That script puts the local username and hostname into a DNS name and looks it up under an OAST domain, disclosing identifying information without installer consent.
AI rationale
The manifest activates the behavior during installation, and the source shows an automatic DNS disclosure of local identifiers to an unrelated OAST collector without a consent gate. This supports blocking as install-hook abuse.
Evidence
package.jsonindex.js
Network endpoints1
msrc-poc.<username>.<hostname>.dbg6vplohjpkmtolbi6g18ekofkxjzm4s.oast.fun
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs index.js automatically during preinstall.
- index.js collects the local username and hostname and places them in a DNS name under an OAST domain.
- index.js sends that name through a DNS lookup without a consent check.
Evidence against
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
NoLicense
Oversized source lightweight scan
evidence/signup.azure.com_main-X2UUFOOI.js4.28 MB file, sampled 256 KB
NetworkHighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg4"scripts": {
"preinstall": "node index.js"
}
}
High
Ai Review Evidence
package.json runs index.js automatically during preinstall.
package.jsonView on unpkg · L4evidence/signup.azure.com_main-X2UUFOOI.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 9950553e9f5cb946
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @azure-growth/signup-ux-components@1.2.2
matchedPath = evidence/signup.azure.com_main-X2UUFOOI.js
matchedIdentity = npm:[redacted]:1.2.2
similarity = 1.000
shingleOverlap = 2
summary = package final verdict is malicious
Findings
5 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signatureevidence/signup.azure.com_main-X2UUFOOI.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumOversized Source Fileevidence/signup.azure.com_main-X2UUFOOI.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @azure-growth/signup-ux-components@1.2.3.
See all versions of @azure-growth/signup-ux-components for other recorded verdicts.
- Avoid installing @azure-growth/signup-ux-components@1.2.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.