registry / Data exfiltration / enbd-react-logger
enbd-react-logger
A utility package that reports runtime errors to Sentry using @sentry/node.
This report shows the evidence for enbd-react-logger@4.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms unconsented install-time network telemetry to a hardcoded Sentry project plus public IP collection. Although the package exposes a plausible logging API, executing that reporting path in preinstall is concrete malicious install-hook abuse.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install runs package.json preinstall
Impact
Consumer install environment public IP and Sentry event metadata can be sent to the package-controlled Sentry project without user opt-in.
Mechanism
install-time Sentry telemetry and public IP collection
Attack narrative
On npm install, the preinstall hook installs @sentry/node and runs examples/verify.js. That script imports the package, initializes Sentry using the hardcoded default DSN, calls a Cloudflare trace endpoint to resolve the host public IP, sets that IP as Sentry user context, deliberately throws/captures an error, and flushes telemetry. The behavior is not merely an exported logging utility because it executes during install without consumer application opt-in.
AI rationale
Source inspection confirms unconsented install-time network telemetry to a hardcoded Sentry project plus public IP collection. Although the package exposes a plausible logging API, executing that reporting path in preinstall is concrete malicious install-hook abuse.
Evidence
package.jsonexamples/verify.jssrc/index.jssrc/index.d.tsREADME.md
Network endpoints4
abbfc11111e117a3556e36aa8f778f4b@o4510485815754752.ingest.us.sentry.io/4511675212038149www.cloudflare.com/cdn-cgi/traceone.one.one.one/cdn-cgi/trace1.1.1.1/cdn-cgi/trace
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json preinstall runs npm install @sentry/node && node examples/verify.js during consumer install
- examples/verify.js calls init() with no DSN, so src/index.js falls back to a hardcoded Sentry DSN
- examples/verify.js calls setUserFromPublicIp with Cloudflare trace URL during preinstall
- examples/verify.js intentionally triggers an exception via check() and flushes Sentry events during preinstall
- src/index.js defaults sendDefaultPii: true and reports captured exceptions to Sentry
Evidence against
- No child_process beyond declared lifecycle command, eval/vm/Function, native/binary loading, persistence, destructive writes, or AI-agent control-surface writes found
- Runtime logging API is package-aligned when explicitly used by an application
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = npm install @sentry/node && node examples/verify.js
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.preinstall = npm install @sentry/node && node examples/verify.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/index.jsView file
•matchType = normalized_sha256
matchedPackage = sams-sr-sdk-h5@7.0.0
matchedPath = src/index.js
matchedIdentity = npm:c2Ftcy1zci1zZGstaDU:7.0.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/index.jsFindings
1 Critical3 High2 Medium3 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritysrc/index.js
HighKnown Malware Source Fingerprint Signaturesrc/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to enbd-react-logger@4.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing enbd-react-logger@4.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.