registry / Credential exfiltration / @qlik/carboncopy

@qlik/carboncopy

This report shows the evidence for @qlik/carboncopy@1.1.6, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The automatic execution chain and obfuscated token-oriented payload establish concrete malicious install-time behavior. The scaffold CLI and normal template artifacts do not explain it.

Static reason

One or more suspicious static signals were detected.

Trigger

npm preinstall

Impact

Potential theft of GitHub credentials and arbitrary install-time code execution.

Mechanism

downloaded-runtime execution of an obfuscated credential-harvesting payload

Attack narrative

On npm installation, preinstall runs setup.mjs. It either invokes a local Bun executable or downloads a platform-specific Bun ZIP from GitHub, extracts it, and executes math_init.js. That large obfuscated payload dynamically accesses filesystem, OS, path, and child-process facilities, contains GitHub-token handling paths, and includes network/client logic. This is unrelated to the advertised React Native template CLI and executes without user invocation.

AI rationale

The automatic execution chain and obfuscated token-oriented payload establish concrete malicious install-time behavior. The scaffold CLI and normal template artifacts do not explain it.

Evidence

package.jsonsetup.mjsmath_init.js

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs `node setup.mjs` as preinstall.
setup.mjs downloads and executes Bun during install without a checksum.
setup.mjs executes the bundled obfuscated math_init.js payload.
math_init.js contains token-focused paths including ghtoken, ghs_old, and ghs_jwt plus network/client logic.
math_init.js dynamically loads fs, os, path, and child_process and suppresses failures.

Evidence against

The documented CLI scaffolds a React Native template and its project-file edits are user-invoked.
The Gradle JAR is a normal ZIP-format wrapper artifact.

Behavioral surface

Source

ChildProcessEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 743 KB of source, external domains: github.com, picsum.photos

Source & flagged code

9 flagged

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

setup.mjsView file

1#!/usr/bin/env node L2: import { execFileSync } from "child_process"; L3: import _0x488df8 from "fs";

High

Child Process

Package source references child process execution.

setup.mjsView on unpkg · L1

252} L253: if (_0x5d8a27.lQXcL(process.platform, _0x5d8a27.MJNCi) && _0x5d8a27.WaLKQ(hc, "powershell", [_0x5d8a27.PpNLF])) { L254: _0x5d8a27.tHRFe(execFileSync, "powershell", [_0x5d8a27.DVCdV, _0x5d8a27.PZdQt, _0x5d8a27.NaIqo, "Bypass", _0x5d8a27.XFZDA, "Expand-Archive -LiteralPath '" + _0x53801b + "' -Destina...

High

Shell

Package source references shell execution.

setup.mjsView on unpkg · L252

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

bin/setupExample.jsView file

5console.log(args); L6: const myShellScript = exec(`npx react-native init ${args[0]} --template https://github.com/qlik-oss/carboncopy`); L7:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/setupExample.jsView on unpkg · L5

bin/index.shView file

•path = bin/index.sh kind = build_helper sizeBytes = 113 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/index.shView on unpkg

template/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = high_entropy_blob sizeBytes = 59536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = compressed_blob sizeBytes = 59536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

template/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 59536 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

template/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

setup.mjsView file

1#!/usr/bin/env node L2: import { execFileSync } from "child_process"; L3: import _0x488df8 from "fs";

High

Child Process

Package source references child process execution.

setup.mjsView on unpkg · L1

High

Shell

Package source references shell execution.

setup.mjsView on unpkg · L252

Findings

5 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsetup.mjs

HighShellsetup.mjs

HighRuntime Package Installbin/setupExample.js

HighShips High Entropy Blobtemplate/android/gradle/wrapper/gradle-wrapper.jar

MediumNetwork

MediumShips Build Helperbin/index.sh

MediumShips Compressed Blobtemplate/android/gradle/wrapper/gradle-wrapper.jar

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalmath_init.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @qlik/carboncopy@1.1.6.

The versions list below shows the verdict for each recorded version.

Avoid installing @qlik/carboncopy@1.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 08:51:09.499Z (UTC).

Source advisory published: 2026-08-04 15:50:08.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.1.6latestshownMaliciousCredential ExfiltrationBlockPublishedAug 4, 2026, 10:46 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @qlik

Other credential exfiltration packages

Behavioral surface

Related packages

More from @qlik

Other credential exfiltration packages

Source & flagged code