dependencykfeg@25.1.3
Account utility library
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe newly added remote-tarball dependency executes a preinstall hook that collects local identifiers and public network details, then sends them to a dynamically supplied external host. This is install-time data exfiltration without installer consent.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing dependencykfeg causes its remote-tarball dependency's preinstall hook to run.
Impact
Installation exposes the user's username, hostname, home directory, working directory, platform, and public network details to an externally selected host.
Mechanism
The hook fetches a destination hostname from a GitHub file, gathers local identifiers and public IP details using shell commands and ipinfo.io, then posts the data over HTTPS.
Attack narrative
On installation, the package pulls a dependency from a remote tarball whose preinstall hook runs automatically. The hook obtains a destination from a GitHub-hosted file, collects user and machine identifiers plus public IP details, and sends them in an HTTPS POST to that destination.
AI rationale
The newly added remote-tarball dependency executes a preinstall hook that collects local identifiers and public network details, then sends them to a dynamically supplied external host. This is install-time data exfiltration without installer consent.
Evidence
package.json.lpm-dependency-evidence-3841afff-d6e8-47f8-8ea5-23cbbad66170/0/npm-linux/package.json.lpm-dependency-evidence-3841afff-d6e8-47f8-8ea5-23cbbad66170/0/npm-linux/index.js
Network endpoints3
raw.githubusercontent.com/GamerD11/ping_test/main/burp_collaborator.txtipinfo.io/jsonHost returned by burp_collaborator.txt:443/ (dynamic)
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package adds a dependency from a remote GitHub tarball URL.
- That dependency runs index.js as a preinstall hook when installed.
- The hook collects the username, hostname, home directory, working directory, platform, and public IP and network organization details.
- The hook sends the collected data by HTTPS POST to a host fetched from a GitHub file.
Evidence against
- The package's own index.js only exports an empty object.
Behavioral surface
Trivial
Source & flagged code
7 flaggedpackage.jsonView file
7"node-acct-utilssss21": "https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz"
},
"keywords": [],
"author": "",
"license": "ISC"
}
High
Suspicious Dependency Evidence
The package adds a dependency from a remote GitHub tarball URL.
package.jsonView on unpkg · L7•Remote tarball dependency specs: node-acct-utilssss21@https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkg.lpm-dependency-evidence-3841afff-d6e8-47f8-8ea5-23cbbad66170/0/npm-linux/package.jsonView file
6"preinstall": "node index.js"
}
}
Findings
6 High1 Medium
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-3841afff-d6e8-47f8-8ea5-23cbbad66170/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-3841afff-d6e8-47f8-8ea5-23cbbad66170/0/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-3841afff-d6e8-47f8-8ea5-23cbbad66170/0/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-3841afff-d6e8-47f8-8ea5-23cbbad66170/0/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-3841afff-d6e8-47f8-8ea5-23cbbad66170/0/npm-linux/index.js
MediumRemote Tarball Dependencypackage.json
Affected versions and remediation
This report applies to dependencykfeg@25.1.3.
See all versions of dependencykfeg for other recorded verdicts.
- Avoid installing dependencykfeg@25.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.