registry / Data exfiltration / @coopeuch/common

@coopeuch/common

Coordinated vulnerability disclosure proof of concept for a dependency confusion issue.

This report shows the evidence for @coopeuch/common@1.999.999. 1 of 3 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The automatic install hook collects identifying host and environment information and transmits it to an external endpoint without an opt-in. This is concrete install-time data exfiltration.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Package installation runs the postinstall hook.

Impact

An external recipient receives identifying information about the host and its build environment.

Mechanism

The hook builds a report from operating system, user, machine, network, and install context, then sends it in an HTTPS POST request.

Attack narrative

During installation, the package collects host and user identifiers and environment details, then posts the report to collector.oob.s4yhii.com. The hook runs without an explicit opt-in. Although the report filters environment variables to names only, it includes identifying host information and network details.

AI rationale

The automatic install hook collects identifying host and environment information and transmits it to an external endpoint without an opt-in. This is concrete install-time data exfiltration.

Evidence

package.jsonpostinstall.js

Network endpoints1

collector.oob.s4yhii.com

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs postinstall.js automatically during installation.
postinstall.js collects host and user identity, install paths, network interface details, and machine characteristics.
postinstall.js sends the report by HTTPS POST to collector.oob.s4yhii.com.
The postinstall path invokes the send routine without an opt-in gate.

Evidence against

The hook filters environment variables by name and does not include their values in its report.
The package entry point is a placeholder module; the reported collection and network behavior is in the install hook.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 2 file(s), 7.62 KB of source

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node ./postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "postinstall": "node ./postinstall.js" }, "file

High

Suspicious Lifecycle Evidence

package.json runs postinstall.js automatically during installation.

package.jsonView on unpkg · L10

•scripts.postinstall = node ./postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

17const fs = require("fs"); L18: const dns = require("dns"); L19: const path = require("path"); ... L24: "npm_command", L25: "npm[redacted]", L26: "npm[redacted]", L27: "npm[redacted]", L28: "npm[redacted]", L29: "npm[redacted]", ... L47: try { L48: pkg = require("./package.json"); L49: } catch (e) {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L17

•matchType = normalized_sha256 matchedPackage = @coopeuch/core@1.999.999 matchedPath = postinstall.js matchedIdentity = npm:QGNvb3BldWNoL2NvcmU:1.999.999 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1242e05b01062ef0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @coopeuch/core@1.999.999 matchedPath = postinstall.js matchedIdentity = npm:QGNvb3BldWNoL2NvcmU:1.999.999 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

141installDir: __dirname, cwd: process.cwd(), hostname: os.hostname(), username: os.userInfo().username, uid: typeof process.getuid === "function" ? process.getuid() : null, gid: typeof process.getgid === "function" ? process.getgid() : null, homedir: os.homedir(), platform: os.platform(), arch: os.

High

Suspicious Lifecycle Evidence

postinstall.js collects host and user identity, install paths, network interface details, and machine characteristics.

postinstall.jsView on unpkg · L141

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "postinstall": "node ./postinstall.js" }, "file

High

Suspicious Lifecycle Evidence

package.json runs postinstall.js automatically during installation.

package.jsonView on unpkg · L10

•scripts.postinstall = node ./postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Findings

6 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationpostinstall.js

HighKnown Malware Source Similaritypostinstall.js

HighKnown Malware Source Fingerprint Signaturepostinstall.js

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencepostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowNo License

Affected versions and remediation

This report applies to @coopeuch/common@1.999.999.

The versions list below shows the verdict for each recorded version.

Avoid installing @coopeuch/common@1.999.999. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-12 19:30:04.557Z (UTC).

Source advisory published: 2026-10-11 13:58:48.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.0.1-securitylatestUnknown—AllowUnder ReviewOct 12, 2026, 7:06 PM 0.0.0-stageClean—AllowPublishedOct 12, 2026, 7:05 PM 1.999.999shownMaliciousData ExfiltrationBlockPublishedOct 11, 2026, 2:09 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @coopeuch

Other data exfiltration packages

Source & flagged code

Related packages

More from @coopeuch

Other data exfiltration packages