registry / @mexc/shared-utils / 2.0.0

@mexc/shared-utils@2.0.0

dios confirming for bugrap and mexc that this namespace is taken

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Installing the package executes postinstall.js without user invocation. It harvests basic host metadata and writes a proof file to the OS temp directory.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

Unconsented installation-side host fingerprinting and filesystem mutation.

Mechanism

install-time host metadata collection and temp-file write

Attack narrative

On npm installation, package.json invokes postinstall.js. The script collects host and user metadata, prints takeover messaging, and writes it to mexc-confirmation-dios.txt in the operating system temporary directory. The source explicitly frames this as a dependency-confusion takeover confirmation.

Rationale

The package has an unconsented postinstall that collects system/user data and mutates the filesystem, explicitly presented as dependency-confusion proof behavior. No exfiltration endpoint is needed to establish the malicious install-time action.

Evidence

package.jsonpostinstall.jsindex.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs postinstall via node postinstall.js.

@mexc/shared-utils@2.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code