registry / create-coin / 20.1.1

create-coin@20.1.1

netbsd-x64 build for esbuild

AI Security Review

scanned 3h ago · by lpm-firewall-ai

npm installation automatically runs a delayed payload that evades common analysis environments. It harvests project and host data, executes reconnaissance commands, probes localhost, and exfiltrates results.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Disclosure of environment variables, npm credentials, project configuration, host identity, command output, and local service presence.

Mechanism

delayed C2-backed credential and host-data exfiltration

Attack narrative

On installation, postinstall launches build/payload.node.js. The payload skips CI, audit, and container environments, delays execution, then POSTs host and project data to a configurable C2. It reads project configuration files, every environment variable, and the user npm configuration; it also executes system/npm reconnaissance and scans selected localhost ports. A lock file limits repeat execution.

Rationale

This is concrete, stealth-oriented install-time credential and data exfiltration with no legitimate functional purpose. Block publication.

Evidence

package.jsonbuild/payload.node.jsindex.js../.ranpackage-lock.json.envsrc/config.tssrc/config.js~/.npmrc

Network endpoints6

random-name.trycloudflare.com127.0.0.1:3000

create-coin@20.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code