claims-acct-unlock@25.2.1
Account utility library
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package installs a dependency whose preinstall hook automatically collects host and project details and sends them to a fetched callback endpoint. This is unconsented install-time data exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
Installation of claims-acct-unlock triggers the dependency's preinstall script.
Impact
The installer’s username, hostname, home directory, working directory, and public IP and organization information are disclosed without consent.
Mechanism
The script fetches a callback hostname from raw.githubusercontent.com, collects local identity and environment details plus IP information from ipinfo.io, and POSTs the data to that hostname.
Attack narrative
Installing the package runs its dependency’s preinstall hook. The hook retrieves a callback hostname, gathers the installer’s username, hostname, home and working directories, runtime details, and public IP and organization data, then sends that information in an HTTPS POST to the callback host.
AI rationale
The package installs a dependency whose preinstall hook automatically collects host and project details and sends them to a fetched callback endpoint. This is unconsented install-time data exfiltration.
Evidence
package.json.lpm-dependency-evidence-df5ff4be-a91a-443c-80ec-63fd67f2ebff/0/npm-linux/package.json.lpm-dependency-evidence-df5ff4be-a91a-443c-80ec-63fd67f2ebff/0/npm-linux/index.js
Network endpoints3
raw.githubusercontent.comipinfo.iohostname read from burp_collaborator.txt
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package depends on node-acct-utilssss21 through a GitHub-hosted tarball URL.
- The dependency runs index.js automatically during its preinstall hook.
- The hook fetches a callback host and collects the username, hostname, working directory, and IP and organization data.
- The hook POSTs the collected data, including the home directory, to the fetched callback host.
Evidence against
Behavioral surface
Source & flagged code
5 flaggedpackage.jsonView file
6"dependencies": {
"node-acct-utilssss21": "https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-util
High
Ai Review Evidence
The package depends on node-acct-utilssss21 through a GitHub-hosted tarball URL.
package.jsonView on unpkg · L6•Remote tarball dependency specs: node-acct-utilssss21@https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkg.lpm-dependency-evidence-df5ff4be-a91a-443c-80ec-63fd67f2ebff/0/npm-linux/package.jsonView file
4"main": "index.js",
"scripts": {
"preinstall": "node index.js"
Findings
4 High1 Medium
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-df5ff4be-a91a-443c-80ec-63fd67f2ebff/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-df5ff4be-a91a-443c-80ec-63fd67f2ebff/0/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-df5ff4be-a91a-443c-80ec-63fd67f2ebff/0/npm-linux/index.js
MediumRemote Tarball Dependencypackage.json
Affected versions and remediation
This report applies to claims-acct-unlock@25.2.1.
See all versions of claims-acct-unlock for other recorded verdicts.
- Avoid installing claims-acct-unlock@25.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.