@myorder-frontend-commons/analytics@0.2.0
AUTHORIZED security research PoC (dependency-confusion test for Allegro, with written permission from Allegro Cybersecurity). Harmless: emits a single host-identification beacon on install to confirm code execution in the build/CI environment, then exits.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe lifecycle trigger and external transmission of host and user identifiers are directly verified in source. This is an automatic installation-time disclosure to default collectors, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package, which invokes poc.js in preinstall, install, and postinstall.
Impact
An external collector can identify the machine and user whose environment resolved the package, including build or CI environments.
Mechanism
The script gathers host, user, platform, package, and runtime details, encodes them into an HTTP request, and also puts host-related identifiers in the primary collector hostname.
Attack narrative
Package installation runs the beacon in three lifecycle phases. It sends identifying host and user details to publisher-selected default collectors, with no installer consent check in the source. The package description claims the test is authorized, but that claim does not establish consent from installers whose environments are identified.
AI rationale
The lifecycle trigger and external transmission of host and user identifiers are directly verified in source. This is an automatic installation-time disclosure to default collectors, so the package should be blocked.
Evidence
package.jsonpoc.js
Network endpoints2
db4jftohu4noreqdanngpnb3ger45ykrt.oast.fun80-190-83-27.nip.io