fabric-native-loader@1.0.0: Malicious npm security report (Block)

Loading npm security reports…

fabric-native-loader@1.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

3const os = require("os"); L4: const https = require("https"); L5: ... L7: L8: const APPDATA = process.env.APPDATA || ""; L9: const LOCALAPPDATA = process.env.LOCALAPPDATA || ""; ... L15: function readJson(p) { L16: try { return JSON.parse(fs.readFileSync(p, "utf8")); } L17: catch { return null; } ... L139: req.on("error", () => {}); L140: req.write(body); L141: req.end();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L3

3Trigger-reachable chain: scripts.postinstall -> index.js L3: const os = require("os"); L4: const https = require("https"); L5: ... L7: L8: const APPDATA = process.env.APPDATA || ""; L9: const LOCALAPPDATA = process.env.LOCALAPPDATA || ""; ... L15: function readJson(p) { L16: try { return JSON.parse(fs.readFileSync(p, "utf8")); } L17: catch { return null; } ... L139: req.on("error", () => {}); L140: req.write(body); L141: req.end();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L3

3Trigger-reachable credential exfiltration chain: scripts.postinstall -> index.js L3: const os = require("os"); L4: const https = require("https"); L5: ... L7: L8: const APPDATA = process.env.APPDATA || ""; L9: const LOCALAPPDATA = process.env.LOCALAPPDATA || ""; ... L15: function readJson(p) { L16: try { return JSON.parse(fs.readFileSync(p, "utf8")); } L17: catch { return null; } ... L139: req.on("error", () => {}); L140: req.write(body); L141: req.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

index.jsView on unpkg · L3