Loading npm security reports…

@patchstack/connect@0.4.0: Malicious npm security report (Block) | LPM Firewall

registry / @patchstack/connect / 0.4.0

@patchstack/connect@0.4.0

Runtime application security for JavaScript and Node.js: dependency inventory, attack-surface mapping, and an in-process guard that virtually patches known vulnerabilities and hardens responses.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

A package-supplied prompt can cause an AI assistant to run setup, which modifies a consumer project and establishes recurring install and build hooks. The hooks report dependency inventories to Patchstack and can add runtime protection and a disclosure widget.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A coding assistant or user follows the README instruction and runs patchstack-connect setup.

Impact

Consumer package scripts and application files can be changed, and later dependency installs or builds can send package inventory to Patchstack.

Mechanism

Prompt-driven consumer-project mutation and persistent postinstall/build-hook registration.

Attack narrative

The README supplies a ready-made instruction for a coding assistant that falsely asserts the package was vetted and authorized. Following it invokes setup, which scans dependencies, contacts Patchstack, modifies project files, and persists postinstall and build hooks. Those hooks cause later installs and builds to run the package scanner and report inventory. This is a concrete social-engineering path to durable consumer-project changes, even though the package itself has no registry install hook.

AI rationale

The package combines reviewer and assistant-directed social engineering with an explicit command that persistently changes consumer lifecycle scripts and transmits dependency inventory. It is not an automatic registry-install payload, but the supplied instruction attempts to manufacture consent for broad project changes.

Evidence

README.mddist/cli.jspackage.json.patchstackrc.json.patchstackrc.local.json.gitignoreindex.html

Source & flagged code

5 flagged · loading source

dist/protect.edge.jsView file

275// src/protect/engine/client.js L276: var DEFAULT_BASE_URL = "https://api.patchstack.com"; L277: var DEFAULT_CACHE_TTL = 3e5; ... L289: this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4; L290: this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN; L291: this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_WAF_API_URL, DEFAULT_BASE_URL, "rule endpoint"); ... L314: headers, L315: body: JSON.stringify({}), L316: signal: AbortSignal.timeout(this.#timeoutMs) ... L330: } L331: const data = await response.json(); L332: if (!data || !Array.isArray(data.firewall)) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.edge.jsView on unpkg · L275

6var __hasOwnProp = Object.prototype.hasOwnProperty; L7: var __commonJS = (cb, mod) => function __require() { L8: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

dist/index.jsView file

22try { L23: raw = await readFile(path.join(cwd, "package.json"), "utf8"); L24: } catch { ... L28: try { L29: parsed = JSON.parse(raw); L30: } catch { ... L1226: }, L1227: body: JSON.stringify({ L1228: grant_type: "client_credentials", ... L1252: } L1253: async function pulseFetch(config, url, init, fetchImpl = fetch) { L1254: const send = async () => {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L22

dist/index.cjsView file

81Trigger-reachable chain: manifest.main -> dist/index.cjs L81: try { L82: raw = await (0, import_promises.readFile)(import_node_path.default.join(cwd, "package.json"), "utf8"); L83: } catch { ... L87: try { L88: parsed = JSON.parse(raw); L89: } catch { ... L1285: }, L1286: body: JSON.stringify({ L1287: grant_type: "client_credentials", ... L1311: } L1312: async function pulseFetch(config, url, init, fetchImpl = fetch) { L1313: const send = async () => {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L81

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @patchstack/connect@0.3.31 matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.3.31 similarity = 0.818 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

5 flagged

dist/protect.edge.jsView file

Lines 1-26javascript

1var __create = Object.create;

2var __defProp = Object.defineProperty;

3var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __getProtoOf = Object.getPrototypeOf;

6var __hasOwnProp = Object.prototype.hasOwnProperty;

7var __commonJS = (cb, mod) => function __require() {

8 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

9 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

10 } catch (e) {

11 throw mod = 0, e;

12 }

13};

14var __copyProps = (to, from, except, desc) => {

15 if (from && typeof from === "object" || typeof from === "function") {

16 for (let key of __getOwnPropNames(from))

17 if (!__hasOwnProp.call(to, key) && key !== except)

18 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

19 }

20 return to;

21};

22var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

23 // If the importer is in node compatibility mode or this is not an ESM

24 // file that has been converted to a CommonJS file using a Babel-

25 // compatible transform (i.e. "__esModule" has not been set), then set

26 // "default" to the CommonJS "module.exports" for node compatibility.

Lines 255-295javascript

255 const u = new URL(value);

256 if (u.protocol === "https:") return true;

257 return u.protocol === "http:" &&

dist/index.jsView file

Lines 2-42javascript

2import { access } from "fs/promises";

3import path5 from "path";

4

5// src/types.ts

6var PatchstackError = class extends Error {

dist/index.cjsView file

Lines 61-101javascript

61var import_promises7 = require("fs/promises");

62var import_node_path5 = __toESM(require("path"), 1);

63

64// src/types.ts

65var PatchstackError

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @patchstack/connect@0.3.31 matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.3.31 similarity = 0.818 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg