registry / Credential exfiltration / create-coin
create-coin
netbsd-x64 build for esbuild
This report shows the evidence for create-coin@20.1.1, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete, stealth-oriented install-time credential and data exfiltration with no legitimate functional purpose. Block publication.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall
Impact
Disclosure of environment variables, npm credentials, project configuration, host identity, command output, and local service presence.
Mechanism
delayed C2-backed credential and host-data exfiltration
Attack narrative
On installation, postinstall launches build/payload.node.js. The payload skips CI, audit, and container environments, delays execution, then POSTs host and project data to a configurable C2. It reads project configuration files, every environment variable, and the user npm configuration; it also executes system/npm reconnaissance and scans selected localhost ports. A lock file limits repeat execution.
AI rationale
This is concrete, stealth-oriented install-time credential and data exfiltration with no legitimate functional purpose. Block publication.
Evidence
package.jsonbuild/payload.node.jsindex.js../.ranpackage-lock.json.envsrc/config.tssrc/config.js~/.npmrc
Network endpoints6
random-name.trycloudflare.com127.0.0.1:3000127.0.0.1:5000127.0.0.1:8000127.0.0.1:8080127.0.0.1:443
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Postinstall executes payload automatically.
- Payload evades CI/container analysis.
- It sends collected data to a configurable C2.
- It reads project configs, environment, and ~/.npmrc.
- It runs shell commands and probes localhost ports.
Evidence against
- index.js only exports platform metadata.
- No legitimate package functionality is present beyond metadata.
Behavioral surface
ChildProcessFilesystemNetwork
UrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node build/payload.node.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg6"scripts": {
"postinstall": "node build/payload.node.js"
}
High
Suspicious Lifecycle Evidence
Postinstall executes payload automatically.
package.jsonView on unpkg · L6build/payload.node.jsView file
19/* ===== L1 anti-analysis (npm sandbox / CI) ===== */
if (E.CI || E.GITHUB_ACTIONS || E.GITLAB_CI || E.JENKINS_HOME ||
E.TRAVIS || E.CIRCLECI || E.TEAMCITY_VERSION || E.BUILD_ID) return;
if (A.indexOf('audit') > -1 || A.indexOf('--dry-run') > -1 ||
A.indexOf('pack') > -1 || A.indexOf('publish') > -1) return;
try {
var fs0 = require('fs');
if (fs0.existsSync('/.dockerenv')) return;
try {
var cg = fs0.readFileSync('/proc/1/cgroup', 'utf8');
if (cg.indexOf('docker') > -1 || cg.indexOf('kubepods') > -1 ||
cg.indexOf('containerd') > -1) return;
Findings
6 High1 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencebuild/payload.node.js
HighAi Review Evidencebuild/payload.node.js
HighAi Review Evidencebuild/payload.node.js
HighAi Review Evidencebuild/payload.node.js
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to create-coin@20.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing create-coin@20.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.