registry / @cy4dev/cydemo-bg-color / 5.0.0

@cy4dev/cydemo-bg-color@5.0.0

THIS CONTAINS MALWARE FOR DEMO PURPOSES, USE AT YOUR OWN DISCRETION.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installation automatically executes shell commands. It launches an application and forwards selected cloud-related environment values to a local network listener.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall during package installation

Impact

Unconsented execution and exposure of cloud credential-related environment values to localhost:8000.

Mechanism

child-process execution and environment-variable exfiltration

Attack narrative

Installing the package triggers src/postinstall.js. That script uses child_process.exec to open Calculator and runs env filtered for AWS, GCP, and GOOGLE names, piping the resulting values to netcat at localhost:8000. The README disclaimer does not provide installation-time consent or remove the credential-harvesting behavior.

Rationale

The postinstall hook contains concrete, unconsented command execution and credential-related environment harvesting with network forwarding. The benign runtime export does not mitigate this install-time payload.

Evidence

package.jsonsrc/postinstall.jssrc/index.jsREADME.md

Network endpoints1

localhost:8000

Decision evidence

public snapshot

AI called this at 99.0% confidence with false-positive risk.

@cy4dev/cydemo-bg-color@5.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code