registry / @offa/offa-uwk / 999.0.1

@offa/offa-uwk@999.0.1

Internal API utilities

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Install hooks create a host file and execute a beacon. The beacon exfiltrates local host identity and installation context.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation (preinstall and postinstall)

Impact

Unconsented disclosure of hostname, username, working directory, and install time; arbitrary host-path file creation.

Mechanism

install-time host fingerprinting and HTTPS exfiltration

Attack narrative

During npm installation, preinstall writes a file outside the package and postinstall executes index.js. That script gathers local host identity data and sends it to a webhook.site endpoint without user interaction.

Rationale

Direct source inspection confirms unconsented install-time host fingerprinting and external exfiltration. This is concrete malicious behavior, not merely a suspicious primitive.

Evidence

package.jsonindex.js/home/OFFA/flag

Network endpoints1

webhook.site/e6b10849-38dc-4280-a8e3-72ab39cfaf65

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs a preinstall hook that writes /home/OFFA/flag.
package.json runs index.js automatically in postinstall.
index.js collects hostname, local username, cwd, and timestamp.
index.js POSTs the collected data to webhook.site.

Evidence against

No credential-file or environment-variable harvesting was found.
No remote code loading or shell execution was found beyond lifecycle hooks.

Behavioral surface

Source

Network

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 998 B of source

Source & flagged code

3 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = echo 'preinstall running'>/home/OFFA/flag

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

1// index.js L2: const https = require('https'); L3: const os = require('os'); ... L7: const data = JSON.stringify({ L8: hostname: os.hostname(), L9: username: os.userInfo().username, ... L34: L35: req.write(data); L36: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = echo 'preinstall running'>/home/OFFA/flag

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

1// index.js L2: const https = require('https'); L3: const os = require('os'); ... L7: const data = JSON.stringify({ L8: hostname: os.hostname(), L9: username: os.userInfo().username, ... L34: L35: req.write(data); L36: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

Findings

2 High2 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationindex.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LPM CLI

Manifest: clean

Source & flagged code

3 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = echo 'preinstall running'>/home/OFFA/flag

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

1// index.js L2: const https = require('https'); L3: const os = require('os'); ... L7: const data = JSON.stringify({ L8: hostname: os.hostname(), L9: username: os.userInfo().username, ... L34: L35: req.write(data); L36: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1