registry / Credential exfiltration / @cy4dev/cydemo-bg-color
@cy4dev/cydemo-bg-color
THIS CONTAINS MALWARE FOR DEMO PURPOSES, USE AT YOUR OWN DISCRETION.
This report shows the evidence for @cy4dev/cydemo-bg-color@7.0.0. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiConcrete postinstall credential collection and transmission are present in source. The package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install / postinstall
Impact
Exposure of AWS-related credentials or configuration to a local listener; unsolicited process launch.
Mechanism
shell-based environment collection and HTTP exfiltration
Attack narrative
The manifest executes src/postinstall.js automatically during installation. That script invokes curl with data produced by `env | grep AWS`, transmitting matching environment values to http://localhost:8000, then launches the macOS Calculator app. The benign browser helper does not mitigate this unconsented install-time credential-harvesting behavior.
AI rationale
Concrete postinstall credential collection and transmission are present in source. The package should be blocked.
Evidence
package.jsonsrc/postinstall.jssrc/index.jsREADME.md
Network endpoints1
localhost:8000
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs `node src/postinstall.js` on install.
- src/postinstall.js shells out through child_process.exec.
- src/postinstall.js sends AWS-matching environment variables to localhost:8000.
- src/postinstall.js opens Calculator during installation.
Evidence against
- src/index.js only changes a DOM element background color.
- No network or process behavior exists in the runtime library entrypoint.
Behavioral surface
ChildProcessShell
HighEntropyStrings
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node src/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node src/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
1 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @cy4dev/cydemo-bg-color@7.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @cy4dev/cydemo-bg-color@7.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.