registry / Install hook abuse / core-js-gnz
core-js-gnz
Core JavaScript utilities for Node.js
This report shows the evidence for core-js-gnz@1.0.0, the only known version.
AI Security Review
scanned 18d ago · by lpm-firewall-aiInspected source establishes an automatic remote-payload execution attempt unrelated to the advertised buffer utilities. Execution defects and unavailable payload contents limit claims about successful compromise, not the malicious intent of the install hook.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm postinstall on machines with Desktop, Documents or Downloads directories, subject to a daily cache check.
Impact
Potential execution of externally supplied code with the installing user's permissions and disclosure of machine identifiers; successful execution and further collection are unverified.
Mechanism
Download and decrypt remote code, write Python files into a home-directory cache, then launch a detached interpreter.
Attack narrative
Installing the package automatically activates a hook that checks for desktop directories, attempts to report machine identifiers, and retrieves an encrypted Python payload. It decrypts and saves that payload, appends a data-loading and sending call, and attempts to run it silently in a detached process. The malformed hostname and Python separators limit operational reliability but do not explain this behavior as buffer functionality.
AI rationale
Inspected source establishes an automatic remote-payload execution attempt unrelated to the advertised buffer utilities. Execution defects and unavailable payload contents limit claims about successful compromise, not the malicious intent of the install hook.
Evidence
package.jsoninit.js.cache/core-js-buffer/.init_check.cache/core-js-buffer/modules/runtime.py.cache/core-js-buffer/modules/exec_runtime.py
Network endpoints1
helper.businesse-vip1.workers.dev/
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json automatically runs init.js after installation.
- init.js targets an external server and a cache under the user's home directory.
- The install hook attempts to report the hostname, username and system details.
- It downloads an encrypted payload from /e, decrypts it and checks for TelemetrySender.
- It writes Python payload files and adds a call to load and send collected data.
- It launches the downloaded Python code as a detached process with hidden windows and ignored output.
Evidence against
- The buffer.js entrypoint implements ordinary hexadecimal utilities.
- The configured hostname includes a trailing slash, and generated Python contains literal backslash-n separators; these defects may prevent successful execution.
- The remote payload is unavailable for static inspection, so its collection scope is unknown.
Behavioral surface
ChildProcessCryptoFilesystemNetwork
EncryptedExecution
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node init.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"postinstall": "node init.js",
"test": "node test.js"
},
"keywords": [
High
Ai Review Evidence
package.json automatically runs init.js after installation.
package.jsonView on unpkg · L8init.jsView file
•matchType = normalized_sha256
matchedPackage = core-js-buffer@1.0.0
matchedPath = init.js
matchedIdentity = npm:Y29yZS1qcy1idWZmZXI:1.0.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
init.jsView on unpkgFindings
7 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityinit.js
HighKnown Malware Source Fingerprint Signatureinit.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceinit.js
HighSuspicious Lifecycle Evidenceinit.js
HighAi Review Evidenceinit.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to core-js-gnz@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing core-js-gnz@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.