registry / Credential exfiltration / add-two-numbers-x7q9m
add-two-numbers-x7q9m
A tiny package that adds two numbers.
This report shows the evidence for add-two-numbers-x7q9m@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains a concrete, automatic npm-token exfiltration chain in its preinstall hook. The benign arithmetic entrypoint does not mitigate this behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install (preinstall lifecycle)
Impact
npm credential disclosure and potential registry-account compromise
Mechanism
local token harvesting followed by webhook exfiltration
Attack narrative
During npm preinstall, scripts/preinstall.js enumerates the user's Desktop, reads the first .txt file, extracts a value matching npm_[A-Za-z0-9_-]+, logs it, and sends it to a third-party webhook as a URL parameter. This is automatic credential harvesting unrelated to the package's advertised addition function.
AI rationale
The package contains a concrete, automatic npm-token exfiltration chain in its preinstall hook. The benign arithmetic entrypoint does not mitigate this behavior.
Evidence
package.jsonscripts/preinstall.jsindex.jsscripts/postinstall.js~/Desktop/*.txt
Network endpoints1
webhooktest.net/webhook/019fb2f4-bacc-70d0-bc69-04f805508e0d?token=${encodeURIComponent(value)}
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- scripts/preinstall.js reads the user's Desktop directory during npm preinstall.
- It scans a .txt file for an npm_ token pattern.
- Matched token is sent as a webhook query parameter.
- The preinstall script also logs the extracted token.
Evidence against
- index.js only implements numeric addition.
- scripts/postinstall.js only prints a success message.
Behavioral surface
FilesystemNetwork
UrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node scripts/preinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/preinstall.jsView file
•matchType = normalized_sha256
matchedPackage = add-two-numbers-x7q9m@1.0.0
matchedPath = scripts/preinstall.js
matchedIdentity = npm:YWRkLXR3by1udW1iZXJzLXg3cTlt:1.0.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
3 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityscripts/preinstall.js
HighKnown Malware Source Fingerprint Signaturescripts/preinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to add-two-numbers-x7q9m@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing add-two-numbers-x7q9m@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.