registry / @cy4dev/cydemo-bg-color / 7.0.0

@cy4dev/cydemo-bg-color@7.0.0

THIS CONTAINS MALWARE FOR DEMO PURPOSES, USE AT YOUR OWN DISCRETION.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Install-time code harvests AWS-related environment variables and POSTs them to a local HTTP endpoint. It also launches Calculator on macOS.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install / postinstall

Impact

Exposure of AWS-related credentials or configuration to a local listener; unsolicited process launch.

Mechanism

shell-based environment collection and HTTP exfiltration

Attack narrative

The manifest executes src/postinstall.js automatically during installation. That script invokes curl with data produced by `env | grep AWS`, transmitting matching environment values to http://localhost:8000, then launches the macOS Calculator app. The benign browser helper does not mitigate this unconsented install-time credential-harvesting behavior.

Rationale

Concrete postinstall credential collection and transmission are present in source. The package should be blocked.

Evidence

package.jsonsrc/postinstall.jssrc/index.jsREADME.md

Network endpoints1

localhost:8000

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with false-positive risk.

low

Evidence for block

package.json runs `node src/postinstall.js` on install.
src/postinstall.js shells out through child_process.exec.
src/postinstall.js sends AWS-matching environment variables to localhost:8000.
src/postinstall.js opens Calculator during installation.

Evidence against

src/index.js only changes a DOM element background color.
No network or process behavior exists in the runtime library entrypoint.

Behavioral surface

Source

ChildProcessShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.19 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 16-41json

16 "repository": {

17 "type": "git",

18 "url": "git+ssh://git@gitlab.com/cy4n/npm-cydemo-bg-color.git"

19 },

20 "license": "MIT",

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LPM CLI

RuntimeNo engine / OS / CPU constraints

Artifact4.23 KB · 5 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessShellHighEntropyStringsManifest: clean

Source & flagged code

2 flagged

package.jsonView file

Lines 16-41json

16 "repository": {

17 "type": "git",

18 "url": "git+ssh://git@gitlab.com/cy4n/npm-cydemo-bg-color.git"

19 },

20 "license": "MIT",

21 "author": "Chris (Cy)",

22 "type": "module",

23 "exports": {

24 ".": "./src/index.js"

25 },

26 "main": "./src/index.js",

27 "directories": {

28 "example": "example",

29 "test": "test"

30 },

31 "files": [

32 "src"

33 ],

34 "scripts": {

35 "test": "node --test",

36 "postinstall": "node src/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 },

38 "module": "./src/index.js",

39 "sideEffects": false

40}

41