registry / Data exfiltration / http-req-lite
http-req-lite
Simple HTTP request helper with retry and timeout
This report shows the evidence for http-req-lite@1.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains concrete, unconsented install-time shell execution that probes an internal-looking service and exfiltrates retrieved content to an external OAST domain. This is malicious behavior, not a benign runtime HTTP utility.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation via the `postinstall` lifecycle hook.
Impact
May extract internal HTTP content and induce SSRF during dependency installation.
Mechanism
install-time curl-based SSRF probing and data exfiltration
Attack narrative
On installation, `postinstall.js` executes curl pipelines. It fetches content from `tst.woa.com/flag.html` and posts it to an attacker-observable OAST endpoint, then requests an SSRF-forwarding URL targeting the same endpoint. This behavior is unrelated to the advertised HTTP helper and executes without user invocation.
AI rationale
The package contains concrete, unconsented install-time shell execution that probes an internal-looking service and exfiltrates retrieved content to an external OAST domain. This is malicious behavior, not a benign runtime HTTP utility.
Evidence
package.jsonpostinstall.jsindex.js
Network endpoints4
tst.woa.com/flag.htmltst.woa.com/ssrf_forward.phppwpzhsrbtvmfqrqr7onqcwnrcii960up.oastify.com/ssrf1pwpzhsrbtvmfqrqr7onqcwnrcii960up.oastify.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` runs `node postinstall.js` automatically on install.
- `postinstall.js` executes shell commands through `child_process.exec`.
- `postinstall.js` fetches `http://tst.woa.com/flag.html` and POSTs its body to an OAST host.
- `postinstall.js` triggers `ssrf_forward.php` with the external OAST hostname.
Evidence against
- `index.js` only exports a user-invoked `fetch(url)` helper.
- No benign purpose is evident for the install-time network activity.
Behavioral surface
ChildProcessNetwork
TrivialUrlStrings
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
1 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to http-req-lite@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing http-req-lite@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.