registry / app-sca-info-banking / 0.0.24

app-sca-info-banking@0.0.24

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Installation automatically executes code that creates a local marker and contacts an external OAST service. This provides an external signal that the package was installed.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall execution.

Impact

An installer is identified to the external callback operator without an explicit user action.

Mechanism

poc.js writes a temporary file, resolves a generated DNS hostname, and makes an HTTP GET request to a generated OAST hostname.

Attack narrative

The package uses an automatic postinstall hook to run a dependency-confusion proof-of-concept. That code creates a local marker and sends DNS and HTTP callbacks to an external OAST domain, allowing the operator to observe installations. The automatic external callbacks make this concrete install-hook abuse regardless of the script's self-description.

AI rationale

The package performs unsolicited external callbacks during installation through a postinstall hook. This is concrete dependency-confusion install tracking and warrants blocking.

Evidence

package.jsonpoc.js

Network endpoints1

ki6rmdjnq5q8y7v8soxc080fz65ytohd.oastify.com

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17182

app-sca-info-banking@0.0.24

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code