autobahn-electron-probe
A benign placeholder for npm.
This report shows the evidence for autobahn-electron-probe@99.99.3. 3 of 4 known versions are blocked or flagged. See all versions.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is unconsented install-time collection and remote transmission of host-identifying information. The duplicate lifecycle callbacks and suppressed failures make it concrete malicious install-hook behavior.
Decision evidence
public snapshot- The preinstall hook sends the current user, host name, working directory, and timestamp to a remote host.
- The same host fingerprint callback runs again automatically after installation.
- The callback suppresses failures, making the outbound activity less visible to installers.
- The only runtime entrypoint is a static placeholder message.
- No additional package files or payload loaders are present.
Source & flagged code
7 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook sends the current user, host name, working directory, and timestamp to a remote host.
package.jsonView on unpkg · L10The same host fingerprint callback runs again automatically after installation.
package.jsonView on unpkg · L11Findings
Affected versions and remediation
This report applies to autobahn-electron-probe@99.99.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing autobahn-electron-probe@99.99.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.