registry / Data exfiltration / @jm-telefonica/multibrand-components
@jm-telefonica/multibrand-components
This report shows the evidence for @jm-telefonica/multibrand-components@99.9.1, the only known version.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe dependency's automatic preinstall discloses identifying environment data to a fixed, unrelated OAST endpoint. This verified installation-time disclosure supports blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing this package causes its dependency's preinstall script to run.
Impact
The endpoint receives identifying information about the installation environment.
Mechanism
The script encodes the hostname, home directory, and username, places each value in a subdomain, and makes an HTTP request.
Attack narrative
Installing the package installs a tarball dependency whose preinstall script runs automatically. The script encodes the machine hostname, home directory, and username, then sends each value to a fixed OAST endpoint in an HTTP request. The inspected source shows no installer consent guard.
AI rationale
The dependency's automatic preinstall discloses identifying environment data to a fixed, unrelated OAST endpoint. This verified installation-time disclosure supports blocking publication.
Evidence
package.json.lpm-dependency-evidence-001f533c-ed9e-42b0-8653-208220d8e7d7/0/npm-linux/package.json.lpm-dependency-evidence-001f533c-ed9e-42b0-8653-208220d8e7d7/0/npm-linux/test.js.lpm-dependency-evidence-001f533c-ed9e-42b0-8653-208220d8e7d7/0/npm-linux/index.js
Network endpoints1
<encoded-value>.jm-telefonica.4hm5t3gdw3xyspczi1uc5oq30u6ruii7.oastify.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package manifest installs a dependency from a remote tarball.
- The dependency runs a script automatically during preinstall.
- That script hex-encodes the machine hostname, home directory, and username, then calls the request helper with each value.
- The helper places each value in a subdomain of a fixed OAST endpoint and sends an HTTP request to it.
Evidence against
Behavioral surface
Trivial
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
10"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.4.tgz"
},
"author": "",
"license": "ISC"
}
High
Suspicious Dependency Evidence
The package manifest installs a dependency from a remote tarball.
package.jsonView on unpkg · L10•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.4.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkg.lpm-dependency-evidence-001f533c-ed9e-42b0-8653-208220d8e7d7/0/npm-linux/package.jsonView file
7"preinstall": "node test.js > /dev/null 2>&1",
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC"
}
Findings
6 High1 Medium1 Low
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-001f533c-ed9e-42b0-8653-208220d8e7d7/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-001f533c-ed9e-42b0-8653-208220d8e7d7/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-001f533c-ed9e-42b0-8653-208220d8e7d7/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-001f533c-ed9e-42b0-8653-208220d8e7d7/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-001f533c-ed9e-42b0-8653-208220d8e7d7/0/npm-linux/index.js
MediumRemote Tarball Dependencypackage.json
LowScripts Present
Affected versions and remediation
This report applies to @jm-telefonica/multibrand-components@99.9.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @jm-telefonica/multibrand-components@99.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.