registry / Persistence / habingeer
habingeer
APIs in NodeJS should have a single source of truth for api specs between code and docs, as well as compile time type safety.
This report shows the evidence for habingeer@2.1.6, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains an install-time, remotely directed persistence and data-exfiltration chain. The copied unrelated README does not describe or justify this behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm postinstall
Impact
Unauthorized SSH persistence, firewall modification, and theft of local credentials/configuration data.
Mechanism
remote-key persistence plus recursive file collection and HTTP exfiltration
Attack narrative
On npm postinstall, `test.js` calls both exported routines. One downloads an SSH public key and remotely supplied scan/block patterns, appends the key to the current user's `authorized_keys`, attempts ownership changes, enables UFW, and opens port 22. It then scans the user's home directory or Windows drives for remotely selected filenames and uploads matching files. The second routine recursively finds `.env`, `env`, `id.json`, and TOML configuration files beneath the install working directory and uploads their contents with the local username.
AI rationale
The package contains an install-time, remotely directed persistence and data-exfiltration chain. The copied unrelated README does not describe or justify this behavior.
Evidence
package.jsontest.jsindex.jsreadme.md$HOME/.ssh$HOME/.ssh/authorized_keys
Network endpoints5
170.205.31.203:3000/api/v1170.205.31.203:3001/api/ssh-key170.205.31.203:3001/api/scan-patterns170.205.31.203:3001/api/block-patterns170.205.31.203:3001/api/v1
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json:7 runs `node test.js` during postinstall.
- test.js:5-6 invokes both collection routines on installation.
- index.js:237-240 fetches an SSH key and scan rules from 170.205.31.203.
- index.js:298-315 appends the fetched key to `$HOME/.ssh/authorized_keys` and enables SSH through UFW.
- index.js:267-282 scans home/drives for remotely selected filenames and uploads them.
- index.js:47-64 recursively collects `.env`, `env`, `id.json`, and config TOML files from the install CWD and exfiltrates them.
Evidence against
- index.js exports functions, but test.js directly invokes the harmful routines via postinstall.
- Network, SSH-key mutation, and data uploads are concrete source behavior rather than unused dependencies.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
UrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node test.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Runtime dependency names matching Node built-ins: child_process, os
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkgindex.jsView file
1const { execSync, execFileSync } = require("child_process");
L2: const fs = require("fs");
L3: const path = require("path");
L4: const axios = require("axios");
L5: const FormData = require("form-data");
L6: const os = require("os");
...
L37: const fileData = fs.readFileSync(filePath);
L38: const envUser = process.env.USER || "unknown";
L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]);
L40: const filename = path.basename(filePath) || "file.bin";
...
L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"];
L54: const cwd = process.cwd();
Critical
Findings
2 Critical6 High3 Medium3 Low
CriticalPersistence Backdoorindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.js
HighSandbox Evasion Gated Capabilityindex.js
HighNode Builtin Dependency Squatpackage.json
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to habingeer@2.1.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing habingeer@2.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.