registry / Data exfiltration / @usaa-grp-personal-profile/personal-profile-common
@usaa-grp-personal-profile/personal-profile-common
Security research placeholder - Bugcrowd USAA dependency confusion PoC. Contains no functional code. Will be unpublished after verification.
This report shows the evidence for @usaa-grp-personal-profile/personal-profile-common@999.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source confirms automatic lifecycle execution and external DNS transmission of host-derived data. The inert runtime export does not mitigate the install-time behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install
Impact
Exposes build-host identity and project path to a third-party OAST endpoint.
Mechanism
DNS exfiltration of hostname, username, and working directory
Attack narrative
On npm installation, preinstall and postinstall execute beacon.js. It obtains the machine hostname, current OS username, and current working directory, encodes them into DNS labels, and resolves an attacker-controlled oastify.com hostname. This is unconsented install-time data exfiltration, regardless of its stated proof-of-concept purpose.
AI rationale
The source confirms automatic lifecycle execution and external DNS transmission of host-derived data. The inert runtime export does not mitigate the install-time behavior.
Evidence
package.jsonbeacon.jsindex.js
Network endpoints1
pkg.vcbn68mkbhaetxs9jp2mvwq7gympa9s9scu1.oastify.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with false-positive risk.