registry / @khaznatech/common / 99.0.0

@khaznatech/common@99.0.0

KhaznaTech shared common utilities for Node.js services

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Installing the package invokes a preinstall script that transmits the host name and current install directory's final path segment to an unrelated webhook endpoint. This is undisclosed install-time system-information exfiltration.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install

Impact

Leaks host and installation-context identifiers to a third-party webhook during dependency installation.

Mechanism

preinstall HTTPS telemetry exfiltration

Attack narrative

On npm installation, package.json runs install-report.js. The script reads os.hostname() and derives the final component of process.cwd(), URL-encodes them, then makes a GET request to webhook.site. The endpoint is not package-aligned, and errors are silently ignored. No user action beyond installing the dependency is required.

Rationale

The package performs unconsented, install-time transmission of host and installation-context data to an unrelated webhook endpoint. Its normal runtime entrypoint is benign, but the lifecycle behavior is a concrete exfiltration chain.

Evidence

package.jsoninstall-report.jsindex.jsREADME.md

Network endpoints1

webhook.site/93b065ab-227f-4253-b940-361d00e9b870/

OSV Corroboration

The package's preinstall script (install-report.js) runs automatically on `npm install` and performs an HTTPS GET to a hardcoded webhook.site capture endpoint, appending the installer's hostname (os.hostname()) and current working directory basename (process.cwd()) to the URL path. webhook.site is an anonymous third-party request-capture service, not publisher infrastructure, and the exfiltrated values identify the installer's machine and project. The behavior is labeled as install telemetry in a comment but is not disclosed, not opt-in, and directed at an anonymous endpoint rather than a package-owned or caller-configured destination.

@khaznatech/common@99.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code