cminhouse-api-gateway-nodejs
API Gateway utilities for ChicMic internal services
This report shows the evidence for cminhouse-api-gateway-nodejs@999.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an automatic install-time credential theft and exfiltration chain, not functionality aligned with an API gateway utility. The deliberate delays and environment guards further support malicious intent.
Decision evidence
public snapshot- The postinstall hook automatically runs index.js during installation.
- The entrypoint reads npm, Git, SSH, cloud, AI, and developer credential files from the user's home directory.
- It collects environment variables whose names suggest secrets, tokens, credentials, or passwords.
- It sends a base64-encoded collection payload to a hard-coded external HTTP receiver.
- The exported API functions are simple, but importing the entrypoint also starts the harvesting routine.
- No legitimate gateway functionality explains automatic credential collection and transmission.
Source & flagged code
7 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook automatically runs index.js during installation.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
index.jsView on unpkg · L14Source appears to send environment or credential material to an external endpoint.
index.jsView on unpkg · L14A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L14A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
index.jsView on unpkg · L14Findings
Affected versions and remediation
This report applies to cminhouse-api-gateway-nodejs@999.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing cminhouse-api-gateway-nodejs@999.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.