registry / @mexc/ws / 1.0.0

@mexc/ws@1.0.0

Security placeholder — prevents dependency confusion on @mexc/ws. Published by diosikigai for BugRap PoC.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Installation runs a Node one-liner that collects basic host metadata and drops a local confirmation file. No network endpoint or payload execution is present.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, via postinstall

Impact

Creates a local proof artifact containing basic host context without user consent.

Mechanism

install-time host metadata collection and temp-file write

Rationale

Source inspection confirms an install-time local metadata collection and write, but no concrete exfiltration, remote code execution, persistence, or destructive action. This warrants a warning rather than a block.

Evidence

package.jsonindex.jsOS temp directory/mexc-confirmation-dios.txt

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json defines an unconsented postinstall hook.
The hook collects hostname, username, cwd, platform, and time.
The hook writes mexc-confirmation-dios.txt into the OS temp directory.
package.json describes a dependency-confusion proof of concept.

@mexc/ws@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code