@securihackbot/depconf-stage-1792484738@1.0.0
Dependency-confusion research PoC (authorized). Non-executing placeholder by default.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe automatic install-time disclosure of host and user identifiers to a publisher-selected callback is concrete installation beaconing. The inspected source shows no affirmative installer consent gate, so this warrants blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
Package installation invokes the postinstall lifecycle script.
Impact
The callback recipient can learn identifying information about the installing machine and its package environment.
Mechanism
postinstall.js collects host, user, and runtime identifiers, encodes them into a request parameter, and sends them to the default callback URL; it also performs a DNS lookup using the nonce and configured suffix.
Attack narrative
Installing the package automatically runs postinstall.js. The hook gathers host and user identifiers and runtime details, then sends them to a default callback endpoint; an environment override does not make the default user-selected.
AI rationale
The automatic install-time disclosure of host and user identifiers to a publisher-selected callback is concrete installation beaconing. The inspected source shows no affirmative installer consent gate, so this warrants blocking publication.
Evidence
package.jsonpostinstall.js
Network endpoints1
34.143.131.27:18080/x-VA-1/main.js
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs postinstall.js automatically during installation.
- postinstall.js has a default callback at http://34.143.131.27:18080/x-VA-1/main.js, with an environment override.
- The install hook collects the host name, user name, platform, architecture, Node version, package name, nonce, and finding URL.
- It encodes that data into a request parameter and sends it with an HTTP or HTTPS GET; it also makes a DNS lookup.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
UrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg6"scripts": {
"postinstall": "node postinstall.js"
},
"files": [
"index.js",
"posti
High
Suspicious Lifecycle Evidence
package.json runs postinstall.js automatically during installation.
package.jsonView on unpkg · L6•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall.jsView file
Findings
2 Critical4 High4 Medium2 Low
CriticalHardcoded Runtime Data Exfiltrationpostinstall.js
CriticalTrigger Reachable Dangerous Capabilitypostinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturepostinstall.js
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencepostinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to @securihackbot/depconf-stage-1792484738@1.0.0.
See all versions of @securihackbot/depconf-stage-1792484738 for other recorded verdicts.
- Avoid installing @securihackbot/depconf-stage-1792484738@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.