@iana-rzms/bff-sdk
AUTHORIZED SECURITY-RESEARCH PLACEHOLDER — dependency-confusion PoC for the ICANN bug bounty program. Namespace defensively reserved. Performs only a benign install-time callback (hostname/user/cwd) to confirm resolution; takes no other action. Not a func
This report shows the evidence for @iana-rzms/bff-sdk@1.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete unconsented install-time telemetry exfiltration, not merely a dormant capability. The inert runtime module does not mitigate the preinstall beacon.
Decision evidence
public snapshot- `package.json` runs `node preinstall.js` during installation.
- `preinstall.js` collects hostname, OS username, and working directory.
- `preinstall.js` encodes and sends that data by HTTPS and HTTP GET.
- `preinstall.js` also performs DNS lookup to `poc.k4pzh6vg78iub3vxqhmml2q8wz2qqge5.oastify.com`.
- Install errors are swallowed, making the beacon non-blocking.
- `index.js` is an inert `mergeHeaders` no-op.
- No file writes, shell execution, secret-file reads, or remote code loading were found.
Source & flagged code
2 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @iana-rzms/bff-sdk@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @iana-rzms/bff-sdk@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.