dependencykfeg@25.0.3
Account utility library
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package pulls a remote tarball dependency whose preinstall hook automatically collects user, host, project path, and public network details and sends them to a dynamically fetched collaborator endpoint. This is install-time data exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing this package invokes the dependency's preinstall hook.
Impact
The destination receives identifying details about the installer and its environment without consent.
Mechanism
The hook fetches a destination hostname from a GitHub-hosted text file, gathers local and public IP/ASN data, then sends it in an HTTPS POST.
Attack narrative
On installation, the dependency's preinstall script retrieves a collaborator hostname and gathers the installer’s username, hostname, home and working directories, runtime details, and public IP/ASN information. It posts those details to the fetched destination over HTTPS, without installer consent.
AI rationale
The package pulls a remote tarball dependency whose preinstall hook automatically collects user, host, project path, and public network details and sends them to a dynamically fetched collaborator endpoint. This is install-time data exfiltration.
Evidence
package.json.lpm-dependency-evidence-922e4c50-819f-4a9c-86e9-94b3aaad2428/0/npm-linux/package.json.lpm-dependency-evidence-922e4c50-819f-4a9c-86e9-94b3aaad2428/0/npm-linux/index.js
Network endpoints3
raw.githubusercontent.comipinfo.iohostname fetched at install time from raw.githubusercontent.com/GamerD11/ping_test/main/burp_collaborator.txt
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package depends on node-acct-utils through a remote GitHub tarball URL.
- That dependency runs index.js in its preinstall hook.
- The hook fetches a collaborator hostname and collects the username, hostname, and current working directory; it also queries ipinfo.io for public IP and ASN details.
- It places these machine and network details in a JSON payload and POSTs the payload to the fetched hostname over HTTPS.
Evidence against
Behavioral surface
Trivial
Source & flagged code
6 flaggedpackage.jsonView file
5"main": "index.js",
"dependencies": {
"node-acct-utils": "https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-u
High
Ai Review Evidence
The package depends on node-acct-utils through a remote GitHub tarball URL.
package.jsonView on unpkg · L5•Remote tarball dependency specs: node-acct-utils@https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkg.lpm-dependency-evidence-922e4c50-819f-4a9c-86e9-94b3aaad2428/0/npm-linux/package.jsonView file
4"main": "index.js",
"scripts": {
"preinstall": "node index.js"
}
Findings
5 High1 Medium
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-922e4c50-819f-4a9c-86e9-94b3aaad2428/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-922e4c50-819f-4a9c-86e9-94b3aaad2428/0/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-922e4c50-819f-4a9c-86e9-94b3aaad2428/0/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-922e4c50-819f-4a9c-86e9-94b3aaad2428/0/npm-linux/index.js
MediumRemote Tarball Dependencypackage.json
Affected versions and remediation
This report applies to dependencykfeg@25.0.3.
See all versions of dependencykfeg for other recorded verdicts.
- Avoid installing dependencykfeg@25.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.