forge-extended: Malicious npm security report (Block)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The preinstall hook executes host-data collection without user action and exfiltrates it over HTTPS.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation (preinstall)

Impact

Leaks system identity, DNS configuration, and contents of /etc/passwd and /etc/hosts.

Mechanism

install-time host fingerprinting and file exfiltration

Attack narrative

Installing the package invokes index.js through preinstall. It reads host identity and network details plus /etc/passwd and /etc/hosts, then sends them in an HTTPS POST to a Burp Collaborator-style oastify endpoint.

Rationale

Source directly confirms unconsented install-time collection and exfiltration of local system data. This is concrete malicious behavior, not merely a suspicious primitive.

Evidence

package.jsonindex.js/etc/passwd/etc/hosts

Network endpoints1

67bqctsh977zz60hiszvr1pbc2iu6ku9.oastify.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs `node index.js` in preinstall.
index.js collects hostname, username, home directory, and DNS servers.
index.js reads /etc/passwd and /etc/hosts when present.
index.js POSTs collected data to an oastify host.

Evidence against

Behavioral surface

Source

FilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.97 KB of source

Source & flagged code

4 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = knowledge-grader@1.0.1 matchedPath = index.js matchedIdentity = npm:a25vd2xlZGdlLWdyYWRlcg:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5442fb9217b0dd0a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = knowledge-grader@1.0.1 matchedPath = index.js matchedIdentity = npm:a25vd2xlZGdlLWdyYWRlcg:1.0.1 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = knowledge-grader@1.0.1 matchedPath = index.js matchedIdentity = npm:a25vd2xlZGdlLWdyYWRlcg:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

Findings

4 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationindex.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

LowScripts Present

LowFilesystem