registry / Data exfiltration / com.epi.e2e_test
com.epi.e2e_test
Meta White Hat Researcher
This report shows the evidence for com.epi.e2e_test@1.2.2, the only known version.
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe source establishes automatic collection and external transmission of identifying local information during installation. This concrete data exfiltration supports blocking the package.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package with lifecycle scripts enabled, or importing its entrypoint.
Impact
Exposes identifying host information and local directory paths to the external recipient.
Mechanism
Top-level code gathers operating system information, encodes it as form data, and sends an HTTPS POST without an opt-in check.
Attack narrative
The preinstall hook executes index.js automatically. Its top-level code collects host and installation identifiers, then posts the encoded data to meta.brs.cx. The same behavior runs when the entrypoint is imported. No consent gate restricts this transmission.
AI rationale
The source establishes automatic collection and external transmission of identifying local information during installation. This concrete data exfiltration supports blocking the package.
Evidence
package.jsonindex.js
Network endpoints1
meta.brs.cx
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json automatically runs index.js during preinstall.
- index.js collects the installation directory, home directory, hostname, username, DNS servers, and package metadata.
- index.js encodes the collected data and sends it by HTTPS POST to meta.brs.cx without a consent gate.
Evidence against
- The inspected code does not read credential files or execute downloaded payloads.
Behavioral surface
Network
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg11"preinstall": "node index.js"
}
}
High
Ai Review Evidence
package.json automatically runs index.js during preinstall.
package.jsonView on unpkg · L11index.jsView file
1const os = require("os");
L2: const dns = require("dns");
L3: const querystring = require("querystring");
L4: const https = require("https");
L5: const packageJSON = require("./package.json");
L6: const package = packageJSON.name;
...
L9: p: package,
L10: c: __dirname,
L11: hd: os.homedir(),
L12: hn: os.hostname(),
L13: un: os.userInfo().username,
...
L36: res.on("data", (d) => {
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
index.jsView on unpkg · L1Findings
9 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to com.epi.e2e_test@1.2.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing com.epi.e2e_test@1.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.