registry / Credential exfiltration / f0-data-constructor
f0-data-constructor
Dependency confusion proof of concept package
This report shows the evidence for f0-data-constructor@28.0.0. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms unconsented install-time collection and external transmission of host data. This is concrete malicious behavior, not merely a suspicious primitive.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation (preinstall)
Impact
Leaks host identity, home-directory path, and configured DNS servers to a third party.
Mechanism
install-time host fingerprinting and HTTPS exfiltration
Attack narrative
During npm preinstall, package.json invokes index.js without user action. The script gathers local host and network-configuration identifiers and sends them as JSON to an external oastify.com endpoint, creating a concrete dependency-confusion reconnaissance/exfiltration path.
AI rationale
Direct source inspection confirms unconsented install-time collection and external transmission of host data. This is concrete malicious behavior, not merely a suspicious primitive.
Evidence
package.jsonindex.jsf0-data-constructor-28.0.0.tgz
Network endpoints1
rb6etzw0lznpijvfl5m5ujmyrpxhl99y.oastify.com/hit
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs `node index.js` in preinstall.
- index.js collects hostname, platform, architecture, home path, and DNS servers.
- index.js POSTs the collected JSON to an external OAST host.
- Manifest describes the package as a dependency-confusion proof of concept.
Evidence against
- No additional executable files or dependencies were found.
- No shell execution, payload download, or destructive file operation was found.
Behavioral surface
Network
HighEntropyStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
1const https = require("https");
L2: const os = require("os");
L3: const dns = require("dns");
L4:
L5: const data = JSON.stringify({
L6: hostname: os.hostname(),
L7: platform: os.platform(),
...
L26:
L27: req.write(data);
L28: req.end();
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
index.jsView on unpkg · L1f0-data-constructor-28.0.0.tgzView file
•path = f0-data-constructor-28.0.0.tgz
kind = compressed_blob
sizeBytes = 1209
magicHex = [redacted]
Findings
2 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.js
MediumNetwork
MediumShips Compressed Blobf0-data-constructor-28.0.0.tgz
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowNested Archive Needs Inspectionf0-data-constructor-28.0.0.tgz
LowNo License
Affected versions and remediation
This report applies to f0-data-constructor@28.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing f0-data-constructor@28.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.