css-import-order@1.1.0

NPM

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Installing the package causes npm to resolve a self-named dependency from an unencrypted external HTTP endpoint. The bundled entrypoint itself has no confirmed malicious runtime behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

npm dependency installation

Impact

A network-controlled artifact may be substituted or altered before installation completes.

Mechanism

remote HTTP dependency carrier

Rationale

The HTTP self-dependency is a concrete staged-payload delivery risk, although the bundled source is otherwise non-malicious. Warn rather than block because no install hook or payload execution is present in the inspected files.

Evidence

package.jsonindex.js

Network endpoints1

pack.nppacks.com/npm/css-import-order

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14473

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in css-import-order (npm)

Details

package.json declares the package's own name `css-import-order` as both a dependency and devDependency pointing at `http://pack.nppacks.com/npm/css-import-order` — a non-registry, plain-HTTP, unpinned URL under a domain unrelated to the npm publisher. On `npm install`, npm resolves and unpacks whatever tarball that host returns, executing any lifecycle scripts it contains. Because the source is not the npm registry, there is no integrity or version pinning, and the plain-HTTP transport additionally allows on-path substitution of the served bytes. The shipped index.js is a small benign transformer and carries a header comment reading `This package use for Security Research Testing Purpose.`, but the harmful vector is the install-time resolution to attacker-mutable content at pack.nppacks.com, not the local module code.

css-import-order@1.1.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code