registry / Malware / @coopeuch/config

@coopeuch/config

Coordinated vulnerability disclosure proof of concept for a dependency confusion issue.

This report shows the evidence for @coopeuch/config@1.999.999. 1 of 3 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The source confirms an automatic install hook that collects identifying environment data and sends it to the maintainer's external collector without installer consent. The disclosed proof-of-concept purpose does not establish consent for this disclosure.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package runs its postinstall hook.

Impact

The collector receives identifying build-environment and project data without installer-specific consent.

Mechanism

The hook builds a report from host, user, network, package, consumer-project, and npm configuration data, then sends it in an HTTPS POST to the configured collector.

Attack narrative

The postinstall hook automatically gathers host and user identifiers, network interface details, and consuming-project information. It sends the report to collector.oob.s4yhii.com over HTTPS and invokes that send path without an installer consent guard. This is an automatic install-time disclosure to an unrelated publisher-selected collector.

AI rationale

Evidence

package.jsonpostinstall.js

Network endpoints1

collector.oob.s4yhii.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs postinstall.js automatically during installation.
The hook assembles package, consumer, host, user, and environment identity data into a report.
The hook posts the report to a publisher-selected external collector without a consent check.
The hook invokes the send path unconditionally.

Evidence against

The package describes the behavior as a coordinated disclosure proof of concept.
The inspected hook does not show secret collection, shell execution, file writes, or persistence.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 2 file(s), 7.62 KB of source

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node ./postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"postinstall": "node ./postinstall.js" }, "files": [

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically during installation.

package.jsonView on unpkg · L11

•scripts.postinstall = node ./postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

17const fs = require("fs"); L18: const dns = require("dns"); L19: const path = require("path"); ... L24: "npm_command", L25: "npm[redacted]", L26: "npm[redacted]", L27: "npm[redacted]", L28: "npm[redacted]", L29: "npm[redacted]", ... L47: try { L48: pkg = require("./package.json"); L49: } catch (e) {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L17

•matchType = normalized_sha256 matchedPackage = @coopeuch/core@1.999.999 matchedPath = postinstall.js matchedIdentity = npm:QGNvb3BldWNoL2NvcmU:1.999.999 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1242e05b01062ef0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @coopeuch/core@1.999.999 matchedPath = postinstall.js matchedIdentity = npm:QGNvb3BldWNoL2NvcmU:1.999.999 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

129const cpus = os.cpus() || []; const report = { poc: "dependency-confusion-proof", round: 3, contact: "s4yhii___ (npm) - coordinated vulnerability disclosure", package: pkg.name, version: pkg.version, resolvedFrom: pkg._resolved || null, npm: npmContext(), ciMarkersPresent: ciMarkers(), consumer: consumer(), runtime: runtime(), installDir: __dirname, cwd: process.cwd(), hostname: os.hostname(

High

Ai Review Evidence

The hook assembles package, consumer, host, user, and environment identity data into a report.

postinstall.jsView on unpkg · L129

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"postinstall": "node ./postinstall.js" }, "files": [

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically during installation.

package.jsonView on unpkg · L11

•scripts.postinstall = node ./postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Findings

6 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationpostinstall.js

HighKnown Malware Source Similaritypostinstall.js

HighKnown Malware Source Fingerprint Signaturepostinstall.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowNo License

Affected versions and remediation

This report applies to @coopeuch/config@1.999.999.

The versions list below shows the verdict for each recorded version.

Avoid installing @coopeuch/config@1.999.999. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-12 02:22:14.363Z (UTC).

Source advisory published: 2026-10-11 13:51:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.0.1-securitylatestUnknown—AllowUnder ReviewOct 12, 2026, 7:06 PM 0.0.0-stageClean—AllowPublishedOct 12, 2026, 7:05 PM 1.999.999shownMaliciousMalwareBlockPublishedOct 11, 2026, 2:09 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @coopeuch

Other malware packages

Related packages

More from @coopeuch

Other malware packages

Source & flagged code