@pcb-dp/qa-commons@1.0.10
Authorized Test Package
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package automatically collects host and CI identity details and sends them to a hard-coded external IP during installation. This is install-time data exfiltration unrelated to the package’s stated purpose.
Static reason
One or more suspicious static signals were detected.
Trigger
Runs during postinstall and when the package main entry point is imported.
Impact
Exposes local host and build-environment details to an unrelated endpoint without user consent.
Mechanism
Collects hostname, home directory, platform, and CI provider, then sends them in an HTTPS POST to a hard-coded IP address.
Attack narrative
During installation, the postinstall hook runs index.cjs, which gathers the machine hostname, home directory, platform, and CI provider and POSTs them to a hard-coded IP address. Importing the package also executes the same entry point. This is automatic transmission of local environment data without user consent.
AI rationale
The package automatically collects host and CI identity details and sends them to a hard-coded external IP during installation. This is install-time data exfiltration unrelated to the package’s stated purpose.
Evidence
package.jsonindex.cjs
Network endpoints1
130.162.231.177:8443/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The postinstall script runs index.cjs automatically.
- index.cjs collects the machine hostname, home directory, platform, and CI provider.
- index.cjs POSTs the collected data to the hard-coded endpoint https://130.162.231.177:8443/.
- index.cjs is also the package main entry point, so importing the package runs this code.
Evidence against
- The shown payload does not include credential contents or file contents.
Behavioral surface
EnvironmentVarsNetwork
UrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node ./index.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg10"postinstall": "node ./index.cjs"
},
"license": "UNLICENSED"
}
High
Suspicious Lifecycle Evidence
The postinstall script runs index.cjs automatically.
package.jsonView on unpkg · L105"main": "index.cjs",
"files": [
"index.cjs"
],
"scripts": {
"post
High
Ai Review Evidence
index.cjs is also the package main entry point, so importing the package runs this code.
package.jsonView on unpkg · L5index.cjsView file
Findings
6 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.cjs
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.cjs
HighAi Review Evidenceindex.cjs
HighAi Review Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @pcb-dp/qa-commons@1.0.10.
See all versions of @pcb-dp/qa-commons for other recorded verdicts.
- Avoid installing @pcb-dp/qa-commons@1.0.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.