@s4yhiitestpoc/r2-dns@1.0.0
Round-2 sample: postinstall performs a single DNS lookup against a researcher-controlled domain.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe install-time DNS beacon is an automatic external signal that reveals package installation. The lifecycle declaration and lookup are both confirmed in source.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package runs its postinstall lifecycle hook.
Impact
The external operator can learn that the package was installed.
Mechanism
The hook invokes dns.lookup with a fixed hostname under s4yhii.com.
Attack narrative
The package's postinstall hook runs code that makes a DNS lookup to a fixed external hostname. This reveals the installation event to the domain operator without requiring a user runtime action.
AI rationale
The install-time DNS beacon is an automatic external signal that reveals package installation. The lifecycle declaration and lookup are both confirmed in source.
Evidence
package.jsonpostinstall.js
Network endpoints1
r2-dns.db03o8lag74hsugsg2j091t8mfcf437h3.oob.s4yhii.com
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The postinstall hook automatically runs postinstall.js during installation.
- postinstall.js performs a DNS lookup to a fixed external hostname, signaling that the package was installed.
Evidence against
Behavioral surface
HighEntropyStringsTrivial
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg6"scripts": { "postinstall": "node ./postinstall.js" },
"files": ["README.md", "postinstall.js"]
}
High
Suspicious Lifecycle Evidence
The postinstall hook automatically runs postinstall.js during installation.
package.jsonView on unpkg · L6•scripts.postinstall = node ./postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall.jsView file
Findings
3 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencepostinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @s4yhiitestpoc/r2-dns@1.0.0.
See all versions of @s4yhiitestpoc/r2-dns for other recorded verdicts.
- Avoid installing @s4yhiitestpoc/r2-dns@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.