Loading npm security reports…

habinger: Malicious npm security report (Block) | LPM Firewall

registry / habinger / 2.1.6

habinger@2.1.6

APIs in NodeJS should have a single source of truth for api specs between code and docs, as well as compile time type safety.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Install-time code executes data theft and a remote-access persistence attempt. It exfiltrates selected project and home-directory files to hard-coded IP endpoints and attempts to install a fetched SSH key.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

`npm install` executes `postinstall` → `node test.js`.

Impact

Secret/configuration theft, unauthorized SSH access, and firewall modification.

Mechanism

Remote-directed file exfiltration and SSH authorized-key persistence.

Attack narrative

On installation, `test.js` calls both malicious routines. One searches the installation working directory for common identity/configuration and environment files, prefixes them with the local username, and uploads them. The other retrieves attacker-controlled scan patterns and an SSH key, scans the user home directory, uploads matching files, then on Linux attempts to add the fetched key to `authorized_keys` and enable inbound SSH through `sudo ufw`.

Rationale

Direct source inspection confirms an automatically triggered credential/configuration exfiltration chain plus attempted SSH persistence. The hard-coded external endpoints and remote-controlled key/pattern inputs provide a concrete malicious attack path.

Evidence

package.jsontest.jsindex.js${HOME}/.ssh/authorized_keysprocess.cwd()/**/{id.json,config.toml,Config.toml,env,.env}

Network endpoints5

170.205.31.203:3000/api/v1170.205.31.203:3001/api/ssh-key170.205.31.203:3001/api/scan-patterns170.205.31.203:3001/api/block-patterns/api/v1

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `node test.js` in `postinstall`.
`test.js` invokes both export functions during installation.
`index.js` recursively finds `id.json`, TOML, and env files under the install CWD, then uploads contents.
`index.js` fetches a remote SSH key and appends it to `${HOME}/.ssh/authorized_keys` on Linux.
`index.js` scans the home directory using remotely supplied patterns and uploads matching files.
`index.js` enables SSH through `sudo ufw` commands.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 8.61 KB of source, external domains: 170.205.31.203

Source & flagged code

6 flagged

package.jsonView file

Lines 1-22json

2 "name": "habinger",

3 "version": "2.1.6",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L6

7 "postinstall": "node test.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

9 "publishConfig": {

10 "access": "public"

11 },

12 "dependencies": {

13 "axios": "^1.7.0",

14 "child_process": "^1.0.2",

15 "form-data": "^4.0.0",

16 "os": "^0.1.2"

17 },

18 "keywords": [],

19 "author": "",

20 "license": "ISC",

21 "type": "commonjs"

22}

index.jsView file

Lines 1-21javascript

1const { execSync, execFileSync } = require("child_process");

2const fs = require("fs");

3const path =

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node test.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: child_process, os

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

index.jsView file

1const { execSync, execFileSync } = require("child_process"); L2: const fs = require("fs"); L3: const path = require("path"); L4: const axios = require("axios"); L5: const FormData = require("form-data"); L6: const os = require("os"); ... L37: const fileData = fs.readFileSync(filePath); L38: const envUser = process.env.USER || "unknown"; L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]); L40: const filename = path.basename(filePath) || "file.bin"; ... L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"]; L54: const cwd = process.cwd();

Critical

Findings

2 Critical4 High3 Medium3 Low

CriticalPersistence Backdoorindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationindex.js

HighSandbox Evasion Gated Capabilityindex.js

HighNode Builtin Dependency Squatpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings