registry / atomic-meta-check / 0.0.1

atomic-meta-check@0.0.1

SECURITY PLACEHOLDER — reserves the unclaimed unscoped bin name of @coveo/atomic-component-health-check to prevent a dependency-confusion (npxconfuse) hijack. This is NOT the real tool; use @coveo/atomic-component-health-check.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Installation automatically transmits host-derived telemetry to a third-party OAST endpoint. A DNS fallback leaks a hostname-derived label.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

Unconsented installation-context data exfiltration

Mechanism

postinstall HTTPS and DNS telemetry beacon

Attack narrative

On npm install, the package runs beacon.js. It builds telemetry containing hostname, platform, Node version, and CI status, then sends it to an OAST host over HTTPS; if that fails, it performs a DNS lookup with a hostname-derived subdomain. This is an unconsented install-time network exfiltration channel.

Rationale

The package's stated placeholder purpose does not require automatic external telemetry. Its postinstall beacon exfiltrates host-derived data through both HTTPS and DNS.

Evidence

package.jsonbeacon.jscli.js

Network endpoints2

d9v7gkqgp7glpsfhspo0bnf169cgo7f97.oast.pro/canaryd9v7gkqgp7glpsfhspo0bnf169cgo7f97.oast.pro

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence with false-positive risk.

atomic-meta-check@0.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code