registry / alb-lambda-cdk / 18.2.22

alb-lambda-cdk@18.2.22

A utility package that reports runtime errors to Sentry using @sentry/node.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

`npm` installation automatically runs a verifier that collects the installing machine's public IP and uploads an event to an embedded Sentry project. The event is flushed before installation completes.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Automatic npm `preinstall` execution.

Impact

Discloses installer network identity and Sentry-collected default PII to a package-controlled endpoint without consent.

Mechanism

Install-time public-IP collection and Sentry event exfiltration.

Attack narrative

On npm preinstall, the package installs Sentry, executes `examples/verify.js`, resolves the installing host's public IP through Cloudflare, associates it with the Sentry user, deliberately throws an exception, and flushes the event to an embedded Sentry DSN. This creates unconsented install-time telemetry exfiltration.

Rationale

Source confirms a concrete, automatic install-time collection-and-upload chain rather than a scanner-only similarity match. The behavior is not required to install the library and uses a package-controlled telemetry endpoint.

Evidence

package.jsonexamples/verify.jssrc/index.js

Network endpoints4

www.cloudflare.com/cdn-cgi/traceone.one.one.one/cdn-cgi/trace1.1.1.1/cdn-cgi/trace

alb-lambda-cdk@18.2.22

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code