registry / @dgn-src-click-to-pay-org/srcdcfreleasecert / 374.0.0

@dgn-src-click-to-pay-org/srcdcfreleasecert@374.0.0

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Installation silently sends host/runtime fingerprint metadata to a hard-coded remote endpoint. No credential or file collection is present.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Unconsented disclosure of package and runtime fingerprint data.

Mechanism

HTTP POST install telemetry

Rationale

The package has a concrete undisclosed install-time network telemetry surface, but source inspection shows limited runtime fingerprint collection and no credential theft, payload execution, persistence, or destructive action. This merits a warning rather than a publish block.

Evidence

package.jsonscripts/check-env.jssrc/index.jsREADME.md

Network endpoints1

16-171-38-148.sslip.io:8080/api/install

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13744

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm)

Details

The package's postinstall script POSTs installer metadata (package name/version, platform, arch, Node version, timestamp) over plain HTTP to a hardcoded sslip.io-wrapped bare IP at http://16-171-38-148.sslip.io:8080/api/install. The scoped name mimics an internal corporate org (@dgn-src-click-to-pay-org) and the version is inflated to 374.0.0, matching the canonical dependency-confusion pattern: a lure package published to the public registry to be resolved by internal build systems that mistakenly reach out for a namespace they expected to be private, with a callback that reports successful installs to an attacker-controlled endpoint. The beacon fires automatically on npm install with no user action, revealing internal build host presence and confirming which corporate targets are vulnerable to further dependency-confusion payloads.

@dgn-src-click-to-pay-org/srcdcfreleasecert@374.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code