registry / @offa/offa-uwk / 999.0.1

@offa/offa-uwk@999.0.1

Internal API utilities

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Install hooks create a host file and execute a beacon. The beacon exfiltrates local host identity and installation context.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation (preinstall and postinstall)

Impact

Unconsented disclosure of hostname, username, working directory, and install time; arbitrary host-path file creation.

Mechanism

install-time host fingerprinting and HTTPS exfiltration

Attack narrative

During npm installation, preinstall writes a file outside the package and postinstall executes index.js. That script gathers local host identity data and sends it to a webhook.site endpoint without user interaction.

Rationale

Direct source inspection confirms unconsented install-time host fingerprinting and external exfiltration. This is concrete malicious behavior, not merely a suspicious primitive.

Evidence

package.jsonindex.js/home/OFFA/flag

Network endpoints1

webhook.site/e6b10849-38dc-4280-a8e3-72ab39cfaf65

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

@offa/offa-uwk@999.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code