@opap/player-kyc-widget
Security research PoC reported to Allwyn AG via HackerOne. Emits a single out-of-band callback (hostname/user/cwd/platform) to prove public-registry resolution. No credential, file or environment access.
This report shows the evidence for @opap/player-kyc-widget@3.999.999. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource directly confirms an install-time dependency-confusion payload that exfiltrates host metadata to an attacker-controlled endpoint. Its stated research purpose does not remove the concrete unconsented behavior.
Decision evidence
public snapshot- npm install runs postinstall.js.
- Postinstall collects hostname, username, cwd, and platform.
- It encodes and sends the fingerprint via DNS and HTTPS.
- README confirms a dependency-confusion proof using a higher public version.
- No environment variables, files, or credentials are read.
- Source shows no persistence or host modification.
Source & flagged code
7 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @opap/player-kyc-widget@3.999.999.
The versions list below shows the verdict for each recorded version.
- Avoid installing @opap/player-kyc-widget@3.999.999. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.