registry / colorpicker-ui / 1.2.6

colorpicker-ui@1.2.6

Minimal color picker component for React with HSL and hex support

AI Security Review

scanned 3h ago · by lpm-firewall-ai

npm install automatically executes a reconnaissance and exfiltration script. It gathers host, cloud, network, process, filesystem, and privilege information, then sends it to a third-party webhook.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

Exposure of cloud credentials, Kubernetes token material, host topology, and privileged environment details.

Mechanism

postinstall host/cloud reconnaissance and webhook exfiltration

Attack narrative

On npm install, package.json launches setup.js. The script immediately collects host and sandbox data, attempts Kubernetes and cloud-metadata credential collection, scans local and nearby network ports, gathers process, filesystem, and privilege information, and POSTs serialized results to a fixed webhook.site endpoint. This behavior is unrelated to the advertised color-picker component and is unconsented install-time data exfiltration.

Rationale

Direct inspection confirms a concrete automatic reconnaissance-and-exfiltration chain, not merely suspicious primitives. The benign UI entrypoint does not justify the install-time behavior.

Evidence

package.jsonsetup.jsindex.jsREADME.md

Network endpoints4

webhook.site/3dc365ff-07dd-42e6-b5e7-e707736401fb169.254.169.254/latest/meta-data/metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

colorpicker-ui@1.2.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code