registry / action-slack-message-root / 1.0.1

action-slack-message-root@1.0.1

AI Security Review

scanned 17d ago · by lpm-firewall-ai

Installing the package triggers unconsented host reconnaissance and external transmission. No user command or opt-in gate is present.

Static reason

One or more suspicious static signals were detected.

Trigger

npm preinstall invokes node index.js.

Impact

Host identity, account identity, working directory, and operating-system details are disclosed to an operator-controlled endpoint.

Mechanism

The script runs system commands, builds device metadata, and POSTs it to a fixed external host.

Attack narrative

On package installation, the preinstall hook runs index.js. It collects host metadata and command output from whoami, id, pwd, and uname -a, then sends the resulting JSON to a fixed Burp Collaborator endpoint. The delayed execution and ignored network errors do not require user interaction and make the outbound collection quieter.

AI rationale

This is a concrete install-time reconnaissance and data-exfiltration path to an unrelated fixed endpoint. It is malicious install-hook abuse, not package-aligned setup.

Evidence

package.jsonindex.js

Network endpoints1

x86cmb7n60gbagfm4fdws0nw5nbjzanz.oastify.com

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16323

package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance — os.hostname(), os.platform(), os.arch(), os.release(), os.uptime(), os.cpus(), memory info, and the output of shell commands `whoami`, `id`, `pwd`, and `uname -a` via child_process — and POSTs the JSON payload over plain HTTP to a hardcoded Burp Suite Collaborator subdomain at http://x86cmb7n60gbagfm4fdws0nw5nbjzanz.oastify.com. The package name resembles legitimate Slack-notification tooling, but the shipped code performs only reconnaissance exfiltration with no advertised functionality. The tarball also declares an unpinned dependency on openmct-heatmap ^1.0.1, consistent with a dependency-confusion / research-probe shape. ## Source: ghsa-malware (3ee3ee5a7d3b1f3cc29a7439cd940b7821e5735ae2f7f873b8cd540115315b8b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

action-slack-message-root@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code