@dransay/phone-fix-test
Benign dependency-confusion interaction beacon published at the explicit request of the DrAnsay/YesWeHack triage team (report #YWH-PGM42275-93). No data collection; see README.
This report shows the evidence for @dransay/phone-fix-test@99.0.0. 1 of 2 known versions is blocked or flagged. See all versions.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package performs an automatic external beacon during preinstall, and its source includes unsupported claims of benignness and approval aimed at framing review. This supports blocking as a dependency-confusion probe.
Decision evidence
public snapshot- package.json runs beacon.js automatically during preinstall.
- beacon.js sends a DNS lookup and HTTPS request to a hard-coded external host, using the package name in the request.
- beacon.js comments call the package benign and claim it was approved by a security triage team; those claims do not establish consent.
- The request path contains only the package name; inspected code does not read environment variables or files.
Source & flagged code
6 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json runs beacon.js automatically during preinstall.
package.jsonView on unpkg · L11Source fingerprint signature matches a known malicious package signature; route for source-aware review.
Findings
Affected versions and remediation
This report applies to @dransay/phone-fix-test@99.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @dransay/phone-fix-test@99.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.