registry / @selfpentest/bin-confusion / 1.0.1

@selfpentest/bin-confusion@1.0.1

An example package for training oneself that uses bin confusion to run a script

AI Security Review

scanned 11d ago · by lpm-firewall-ai

A counterfeit npm executable collects environment data and SSH-host information, then transmits it. It activates whenever the package-provided npm command is invoked.

Static reason

No blocking static signals were detected.

Trigger

Invocation of the installed npm bin command.

Impact

Sensitive environment and host information can be exfiltrated to a listener controlled by an attacker.

Mechanism

npm.js gathers environment values and a local SSH file fragment, sends them to http://localhost:1337, then runs npm.

Attack narrative

The package exposes npm.js as a command named npm, creating a command-confusion route. On command execution it calls a collection routine before proxying to the real npm process. That routine reads HOME and SECRET, reads part of the SSH known-hosts file, and places the results in an HTTP request to a local listener. The subsequent npm proxy can make the command appear normal while data is sent.

AI rationale

The active executable performs credential and local-file collection followed by a network send. Its npm command name makes the behavior especially likely to be triggered through command confusion.

Evidence

package.jsonnpm.js

Network endpoints1

localhost:1337

OSV advisory

OpenSSF/OSV

Advisory

package.json registers a `bin` entry named `npm` pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a dependency, any `npm...` invocation in a consuming project's scripts resolves via node_modules/.bin to this shim, executing the shipped code before (or instead of) the real npm. npm.js contains a `steal()` routine that reads process.env.HOME, process.env.SECRET, and the first 30 bytes of ~/.ssh/known_hosts, concatenates them into a query string, and issues a fetch GET to http://localhost:1337/. The destination is loopback in this build, but the collected data (installer SSH known_hosts contents and environment secrets) is packaged into a functioning exfiltration primitive that fires whenever the shadow `npm` shim is invoked from the installer's build scripts. The scope name (`@selfpentest`) and README frame this as a demonstration, but the shipped tarball is a working bin-shadow + credential-read + network-send chain against installers who add it as a dependency.

@selfpentest/bin-confusion@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code