registry / add-two-numbers-x7q9m / 1.0.1

add-two-numbers-x7q9m@1.0.1

A tiny package that adds two numbers.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

A preinstall hook searches the user's Desktop text files for an npm token and exfiltrates a match. It runs automatically during npm installation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install (preinstall lifecycle)

Impact

npm credential disclosure and potential registry-account compromise

Mechanism

local token harvesting followed by webhook exfiltration

Attack narrative

During npm preinstall, scripts/preinstall.js enumerates the user's Desktop, reads the first .txt file, extracts a value matching npm_[A-Za-z0-9_-]+, logs it, and sends it to a third-party webhook as a URL parameter. This is automatic credential harvesting unrelated to the package's advertised addition function.

Rationale

The package contains a concrete, automatic npm-token exfiltration chain in its preinstall hook. The benign arithmetic entrypoint does not mitigate this behavior.

Evidence

package.jsonscripts/preinstall.jsindex.jsscripts/postinstall.js~/Desktop/*.txt

Network endpoints1

webhooktest.net/webhook/019fb2f4-bacc-70d0-bc69-04f805508e0d?token=${encodeURIComponent(value)}

add-two-numbers-x7q9m@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code