dependencykfeg@25.2.1
Account utility library
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package installs a remote-tarball dependency whose preinstall hook automatically collects host, project-location, and network details and sends them to an externally supplied callback. This is install-time data exfiltration unrelated to the package's stated account utility purpose.
Static reason
One or more suspicious static signals were detected.
Trigger
Installation of this package, when npm runs the dependency's preinstall hook.
Impact
Unconsented disclosure of machine, project-location, and network identifying information to an external host.
Mechanism
The hook fetches a callback hostname from raw.githubusercontent.com, gathers the username, hostname, home and working directories, runtime details, and IP and organization data, then posts them over HTTPS.
Attack narrative
Installing this package pulls a dependency from a remote tarball. Its automatic preinstall hook retrieves a callback hostname, collects the installing machine's username, hostname, home and working directories, runtime details, and network identity, then sends that data to the callback over HTTPS.
AI rationale
The package installs a remote-tarball dependency whose preinstall hook automatically collects host, project-location, and network details and sends them to an externally supplied callback. This is install-time data exfiltration unrelated to the package's stated account utility purpose.
Evidence
package.json.lpm-dependency-evidence-3a7bfb34-ee9b-4042-85f3-2556e791b335/0/npm-linux/package.json.lpm-dependency-evidence-3a7bfb34-ee9b-4042-85f3-2556e791b335/0/npm-linux/index.js
Network endpoints3
raw.githubusercontent.comipinfo.iocallback hostname fetched at install time
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest adds a dependency from a remote GitHub tarball.
- That dependency runs index.js automatically during preinstall.
- The hook fetches a callback hostname and gathers machine and network details.
- It posts the collected data to the fetched hostname over HTTPS.
Evidence against
Behavioral surface
Source & flagged code
7 flaggedpackage.jsonView file
•dependencies.dependencykfeg = ^25.1.3
previous = <absent>
independentlyConfirmedMalicious = dependencykfeg@25.2.1 (lpm_ai_confirmed)
Critical
Known Malicious Dependency Insertion
A newly added or changed runtime dependency can resolve to an independently confirmed malicious package version.
package.jsonView on unpkg8"node-acct-utilssss21": "https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz"
},
"keywords": [],
"author": "",
"license": "ISC"
}
High
Suspicious Dependency Evidence
The manifest adds a dependency from a remote GitHub tarball.
package.jsonView on unpkg · L8•Remote tarball dependency specs: node-acct-utilssss21@https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgFindings
1 Critical5 High1 Medium
CriticalKnown Malicious Dependency Insertionpackage.json
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-3a7bfb34-ee9b-4042-85f3-2556e791b335/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-3a7bfb34-ee9b-4042-85f3-2556e791b335/0/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-3a7bfb34-ee9b-4042-85f3-2556e791b335/0/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-3a7bfb34-ee9b-4042-85f3-2556e791b335/0/npm-linux/index.js
MediumRemote Tarball Dependencypackage.json
Affected versions and remediation
This report applies to dependencykfeg@25.2.1.
See all versions of dependencykfeg for other recorded verdicts.
- Avoid installing dependencykfeg@25.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.