registry / Data exfiltration / cursed-ecto-d3ab00

cursed-ecto-d3ab00

ecto module

This report shows the evidence for cursed-ecto-d3ab00@2.0.2. 5 of 5 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Static source inspection confirms automatic install-time execution of credential/file harvesting, shell command execution, and outbound exfiltration. This behavior is unrelated to the claimed empty ecto module and constitutes concrete malware.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install preinstall/postinstall lifecycle scripts, or direct execution of exfil.js

Impact

Leaks secrets, flags, .env contents, filesystem discovery output, and host metadata to attacker-controlled infrastructure.

Mechanism

install-time credential, file, and command-output exfiltration

Attack narrative

On installation, package.json invokes exfil.js during preinstall and postinstall. The script collects host/user/cwd metadata, selected environment variables, common flag and .env paths, and outputs from filesystem/process discovery commands, then transmits the JSON to a webhook.site URL via POST and a base64 query-string GET fallback.

AI rationale

Evidence

package.jsonexfil.jsindex.js/flag/flag.txt/flag/flag.txt/root/flag/root/flag.txt/app/flag/app/flag.txtflagflag.txt../flag.txt/home/node/flag.txt/opt/flag.txt/tmp/flag.txt/app/.env/app/*.env

Network endpoints1

webhook.site/e2e3a401-da3d-4ecb-bc41-d3c4c4b7dddd

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs `node exfil.js` in both preinstall and postinstall lifecycle hooks.
exfil.js imports http/https, child_process, fs, and os for collection and exfiltration.
exfil.js captures env vars matching flag/secret/token/npm patterns.
exfil.js reads flag-like files and .env files from absolute and relative paths.
exfil.js executes shell discovery commands via cp.execSync.
exfil.js sends collected JSON to webhook.site by POST with base64 GET fallback.

Evidence against

index.js only exports an empty object.
No persistence or package-file mutation observed.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 2 file(s), 2.88 KB of source, external domains: webhook.site

Source & flagged code

9 flagged

package.jsonView file

•scripts.preinstall = node exfil.js preinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node exfil.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node exfil.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

exfil.jsView file

1// Exfiltration payload. Uses only Node built-ins so it runs on any Node engine. L2: const https = require("https"); L3: const http = require("http"); L4: const cp = require("child_process"); L5: const fs = require("fs"); ... L11: phase: process.argv[2] || "unknown", L12: host: safe(() => os.hostname()), L13: cwd: safe(() => process.cwd()), ... L24: // Grab any interesting env vars L25: for (const k of Object.keys(process.env)) { L26: if (/flag|secret|token|npm|ecto|corsair|ghost|spectral/i.test(k)) { ... L49: "find / -maxdepth 6 -iname '*flag*' 2>/dev/null | head -n 60",

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

exfil.jsView on unpkg · L1

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

exfil.jsView on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> exfil.js L1: // Exfiltration payload. Uses only Node built-ins so it runs on any Node engine. L2: const https = require("https"); L3: const http = require("http"); L4: const cp = require("child_process"); L5: const fs = require("fs"); ... L11: phase: process.argv[2] || "unknown", L12: host: safe(() => os.hostname()), L13: cwd: safe(() => process.cwd()), ... L24: // Grab any interesting env vars L25: for (const k of Object.keys(process.env)) { L26: if (/flag|secret|token|npm|ecto|corsair|ghost|spectral/i.test(k)) { ... L49: "find / -maxdepth 6 -iname '*flag*' 2>/dev/null | head -n 60",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

exfil.jsView on unpkg · L1

3const http = require("http"); L4: const cp = require("child_process"); L5: const fs = require("fs");

High

Child Process

Package source references child process execution.

exfil.jsView on unpkg · L3

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

exfil.jsView on unpkg · L1

•matchType = token_shingles matchedPackage = cursed-ecto-d3ab00@2.0.0 matchedPath = exfil.js matchedIdentity = npm:Y3Vyc2VkLWVjdG8tZDNhYjAw:2.0.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

exfil.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node exfil.js preinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node exfil.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node exfil.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

exfil.jsView file

Findings

3 Critical4 High5 Medium4 Low

CriticalCredential Exfiltrationexfil.js

CriticalCommand Output Exfiltrationexfil.js

CriticalTrigger Reachable Dangerous Capabilityexfil.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processexfil.js

HighSandbox Evasion Gated Capabilityexfil.js

HighKnown Malware Source Similarityexfil.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to cursed-ecto-d3ab00@2.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing cursed-ecto-d3ab00@2.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-02 19:36:57.603Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

2.0.2latestshownMaliciousData ExfiltrationBlockPublishedJul 2, 2026, 4:51 PM 2.0.1MaliciousMalwareBlockPublishedJul 2, 2026, 4:32 PM 2.0.0MaliciousData ExfiltrationBlockPublishedJul 2, 2026, 4:25 PM 1.0.1MaliciousData ExfiltrationBlockPublishedJul 2, 2026, 12:03 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Source & flagged code

Related packages

Other data exfiltration packages