registry / Credential exfiltration / harmony-app-toolkit
harmony-app-toolkit
description
This report shows the evidence for harmony-app-toolkit@21.0.0. 2 of 2 known versions are blocked or flagged. The newest version, 22.0.0, is blocked. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete, obfuscated, install-time data exfiltration with no user action beyond installation. It meets the blocking threshold.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing harmony-app-toolkit@21.0.0
Impact
Leaks installation-host identity and local account data to an attacker-controlled collection endpoint.
Mechanism
obfuscated install-time shell-based credential and host-data exfiltration
Attack narrative
During npm installation, the preinstall hook runs preinstall.js. That script decodes the hex command stored in preinstall.json and executes it. Static decoding shows a curl POST to eousft8gflamm91.m.pipedream.net containing whoami, pwd, hostname, and /etc/passwd contents.
AI rationale
This is concrete, obfuscated, install-time data exfiltration with no user action beyond installation. It meets the blocking threshold.
Evidence
package.jsonpreinstall.jspreinstall.json/etc/passwd
Network endpoints1
eousft8gflamm91.m.pipedream.net
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Install lifecycle runs preinstall.js.
- preinstall.js hex-decodes a command and executes it via child_process.exec.
- Decoded preinstall.json payload uses curl to exfiltrate user, path, host, and /etc/passwd data to eousft8gflamm91.m.pipedream.net.
Evidence against
- No legitimate package implementation files are present; the package consists only of the install payload and manifest.
Behavioral surface
ChildProcessFilesystem
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node preinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg5"main": "index.js",
"scripts": {
"preinstall": "node preinstall.js"
}
High
•scripts.preinstall = node preinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpreinstall.jsView file
Findings
4 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturepreinstall.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencepreinstall.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to harmony-app-toolkit@21.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing harmony-app-toolkit@21.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.