registry / Data exfiltration / @sapappgyver/appgyver-descriptors
@sapappgyver/appgyver-descriptors
Enterprise-grade utilities with enhanced validation and compatibility layer
This report shows the evidence for @sapappgyver/appgyver-descriptors@9.9.11. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiConcrete obfuscated metadata collection and DNS exfiltration execute automatically at install and import. This is unrelated to the package’s stated utility/descriptors purpose.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install or requiring the package entry point
Impact
Leaks identifying host and project-context metadata to an attacker-controlled domain.
Mechanism
obfuscated host metadata exfiltration via DNS
Attack narrative
The install lifecycle runs index.js, which suppresses errors while loading an obfuscated core module. That module obtains the local OS username, hostname, and current-working-directory basename, sanitizes them, and performs a DNS resolve for a label containing those values and a timestamp under oob.sl4x0.xyz. The same behavior also runs whenever the package is imported, making the exfiltration covert and persistent across normal use.
AI rationale
Concrete obfuscated metadata collection and DNS exfiltration execute automatically at install and import. This is unrelated to the package’s stated utility/descriptors purpose.
Evidence
package.jsonindex.jslib/core.jslib/b02e30.jslib/6ad264.jssrc/network.js
Network endpoints1
oob.sl4x0.xyz
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs `node index.js` during install.
- index.js silently loads `lib/core.js` on install and every import.
- lib/core.js collects OS username, hostname, cwd basename, and timestamp.
- lib/core.js sends the collected fields in a DNS lookup.
- lib/b02e30.js decodes the destination `oob.sl4x0.xyz`.
- lib/6ad264.js deliberately obfuscates loading `os`, `dns`, and `process`.
Evidence against
- No child-process execution or filesystem mutation was found.
- src/network.js is a user-invoked HTTP utility; it is not the install-time payload.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsNetwork
HighEntropyStringsObfuscated
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.install = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
1'use strict';
L2: try { require('./lib/core'); } catch (e) {}
L3:
Medium
src/network.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 526a1294236312cf
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = uploader-frontend@9.9.11
matchedPath = src/network.js
matchedIdentity = npm:dXBsb2FkZXItZnJvbnRlbmQ:9.9.11
similarity = 1.000
shingleOverlap = 7
summary = package final verdict is malicious
Findings
3 High4 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighObfuscated
HighKnown Malware Source Fingerprint Signaturesrc/network.js
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @sapappgyver/appgyver-descriptors@9.9.11.
The versions list below shows the verdict for each recorded version.
- Avoid installing @sapappgyver/appgyver-descriptors@9.9.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.