registry / Data exfiltration / enbd-react-lib
enbd-react-lib
A utility package that reports runtime errors to Sentry using @sentry/node.
This report shows the evidence for enbd-react-lib@8.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package contains legitimate-looking Sentry helpers, but package installation automatically sends data to a hardcoded Sentry project and resolves/attaches the installer's public IP. That install-time network exfiltration is concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install preinstall lifecycle hook
Impact
Installer public IP and generated error/event metadata can be sent to the author's Sentry project during package installation.
Mechanism
install-time Sentry event upload with public IP user context
Attack narrative
On installation, npm runs the preinstall script. That script installs @sentry/node and executes examples/verify.js, which loads the library, initializes Sentry with the package's hardcoded DSN, fetches the machine's public IP from Cloudflare trace, assigns it as Sentry user context, captures a deliberate exception, and flushes the event. This is unconsented install-time telemetry/exfiltration rather than a user-invoked monitoring helper.
AI rationale
The package contains legitimate-looking Sentry helpers, but package installation automatically sends data to a hardcoded Sentry project and resolves/attaches the installer's public IP. That install-time network exfiltration is concrete malicious behavior.
Evidence
package.jsonexamples/verify.jssrc/index.js
Network endpoints4
abbfc11111e117a3556e36aa8f778f4b@o4510485815754752.ingest.us.sentry.io/4511675212038149www.cloudflare.com/cdn-cgi/traceone.one.one.one/cdn-cgi/trace1.1.1.1/cdn-cgi/trace
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json preinstall runs `npm install @sentry/node && node examples/verify.js` during npm install.
- examples/verify.js initializes src/index.js with the default hardcoded Sentry DSN, fetches public IP, captures an artificial error, and flushes events during install.
- src/index.js default DSN points to o4510485815754752.ingest.us.sentry.io and init enables sendDefaultPii true.
- src/index.js getPublicIp fetches Cloudflare trace endpoints and setUserFromPublicIp attaches the resolved IP to Sentry user context.
Evidence against
- No child_process, eval/vm/Function, dynamic require, filesystem writes, persistence, or AI-agent control-surface writes found.
- Runtime library behavior is mostly Sentry helper APIs when called by consumers, but the install hook invokes those APIs automatically.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = npm install @sentry/node && node examples/verify.js
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.preinstall = npm install @sentry/node && node examples/verify.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/index.jsView file
•matchType = normalized_sha256
matchedPackage = sams-sr-sdk-h5@7.0.0
matchedPath = src/index.js
matchedIdentity = npm:c2Ftcy1zci1zZGstaDU:7.0.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/index.jsView on unpkgFindings
1 Critical3 High2 Medium3 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritysrc/index.js
HighKnown Malware Source Fingerprint Signaturesrc/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to enbd-react-lib@8.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing enbd-react-lib@8.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.