registry / Data exfiltration / fundraiserserv
fundraiserserv
Dependency confusion proof of concept package
This report shows the evidence for fundraiserserv@28.0.0. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package performs unconsented install-time fingerprint exfiltration and explicitly identifies itself as a dependency-confusion proof of concept. No benign functionality offsets this concrete attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation invokes the preinstall lifecycle hook.
Impact
Leaks host identity, home-directory path, and DNS configuration to a third party.
Mechanism
preinstall host-fingerprint exfiltration over HTTPS
Attack narrative
On npm installation, the preinstall hook runs index.js. It gathers local host and network-configuration identifiers and POSTs them to an external OAST endpoint, without a user-invoked feature or package functionality justifying the transmission.
AI rationale
The package performs unconsented install-time fingerprint exfiltration and explicitly identifies itself as a dependency-confusion proof of concept. No benign functionality offsets this concrete attack behavior.
Evidence
package.jsonindex.jsfundraiserserv-28.0.0.tgz
Network endpoints1
gyi3gojp8oae58i48u9uh89neek681wq.oastify.com/hit
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json defines preinstall: node index.js.
- index.js collects hostname, platform, architecture, home directory, and configured DNS servers.
- index.js POSTs the collected fingerprint during installation to an external OAST host.
- Manifest describes the package as a dependency-confusion proof of concept.
Evidence against
- No credential-file reads, shell execution, persistence, or destructive writes found.
- Nested archive contains the same manifest and source, with no additional payload found.
Behavioral surface
Network
HighEntropyStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
1const https = require("https");
L2: const os = require("os");
L3: const dns = require("dns");
L4:
L5: const data = JSON.stringify({
L6: hostname: os.hostname(),
L7: platform: os.platform(),
...
L26:
L27: req.write(data);
L28: req.end();
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
index.jsView on unpkg · L1fundraiserserv-28.0.0.tgzView file
•path = fundraiserserv-28.0.0.tgz
kind = compressed_blob
sizeBytes = 1208
magicHex = [redacted]
Findings
2 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.js
MediumNetwork
MediumShips Compressed Blobfundraiserserv-28.0.0.tgz
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowNested Archive Needs Inspectionfundraiserserv-28.0.0.tgz
LowNo License
Affected versions and remediation
This report applies to fundraiserserv@28.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing fundraiserserv@28.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.