registry / @cy4dev/cydemo-bg-color / 7.0.0

@cy4dev/cydemo-bg-color@7.0.0

THIS CONTAINS MALWARE FOR DEMO PURPOSES, USE AT YOUR OWN DISCRETION.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Install-time code harvests AWS-related environment variables and POSTs them to a local HTTP endpoint. It also launches Calculator on macOS.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install / postinstall

Impact

Exposure of AWS-related credentials or configuration to a local listener; unsolicited process launch.

Mechanism

shell-based environment collection and HTTP exfiltration

Attack narrative

The manifest executes src/postinstall.js automatically during installation. That script invokes curl with data produced by `env | grep AWS`, transmitting matching environment values to http://localhost:8000, then launches the macOS Calculator app. The benign browser helper does not mitigate this unconsented install-time credential-harvesting behavior.

Rationale

Concrete postinstall credential collection and transmission are present in source. The package should be blocked.

Evidence

package.jsonsrc/postinstall.jssrc/index.jsREADME.md

Network endpoints1

localhost:8000

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with false-positive risk.

@cy4dev/cydemo-bg-color@7.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code