@myorder-frontend-commons/analytics@101.0.0
AUTHORIZED security research PoC (dependency-confusion test for Allegro, with written permission from Allegro Cybersecurity). Harmless: emits a single host-identification beacon on install to confirm code execution in the build/CI environment, then exits.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe lifecycle hooks activate automatic disclosure of host and CI identifiers to external collectors. This is a concrete install-time data exfiltration behavior and warrants blocking publication.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Package installation runs preinstall, install, and postinstall scripts.
Impact
The collectors receive host, user, working-directory, platform, and CI-environment information without installer-specific consent being established in source.
Mechanism
The lifecycle script gathers host and environment metadata, then makes HTTP requests to two configured or default collector hosts.
Attack narrative
During installation, the package runs a script that gathers identifying host and build metadata and sends it to an OAST collector and a backup host. The source provides no installer consent gate for these requests; research or authorization claims do not establish installer consent.
AI rationale
The lifecycle hooks activate automatic disclosure of host and CI identifiers to external collectors. This is a concrete install-time data exfiltration behavior and warrants blocking publication.
Evidence
package.jsonpoc.js
Network endpoints2
db69ak0hu4nqhtf9omnguspxhjk8kuide.oast.fun80-190-83-27.nip.io