Loading npm security reports…

hypertube-binaries@3.1.12: Malicious npm security report (Block) | LPM Firewall

registry / hypertube-binaries / 3.1.12

hypertube-binaries@3.1.12

Hypertube allows you to reference and use modules or packages written in (Java/Kotlin/Groovy/Clojure, C#/VB.NET, Ruby, Perl, Python, JavaScript/TypeScript) like they were created in your technology. It works on Linux/Windows and MacOS for applications cre

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Runtime error reporting transmits exception text and license-related machine telemetry to an external endpoint. This is not performed by the install hook.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

A Hypertube runtime exception occurs.

Impact

A license key, hostname, operating system, and exception content can leave the host.

Mechanism

Automatic telemetry posts license and host data.

Attack narrative

When its runtime handles an exception, it sends the exception text to its telemetry helper. The helper reads the current license key and host metadata, places them in a JSON payload, and posts it to a hard-coded external telemetry endpoint. This exports a credential-like value and potentially sensitive application error content without a user-controlled reporting action.

AI rationale

The package contains a concrete runtime path that exports license keys, host metadata, and exception text to a third-party endpoint. The benign local build-only install hook does not offset this data-exfiltration behavior.

Evidence

Binaries/Python/hypertube/utils/exception/ExceptionThrower.pyBinaries/Python/hypertube/utils/messageHelper/MessageHelper.py

Network endpoints1

polandcentral-0.in.applicationinsights.azure.com/v2/track

Decision evidence

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.install = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

•matchType = malicious_source_fingerprint_signature signature = 779090be4bdf377b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hypertube-binaries@3.1.13 matchedPath = index.js matchedIdentity = npm:aHlwZXJ0dWJlLWJpbmFyaWVz:3.1.13 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

1const path = require('path'); L2: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView file

•path = [redacted].dylib kind = native_binary sizeBytes = 290176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 709 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Binaries/Jvm/hypertube-java-core.jarView file

•path = Binaries/Jvm/hypertube-java-core.jar kind = high_entropy_blob sizeBytes = 3982209 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

•path = Binaries/Jvm/hypertube-java-core.jar kind = compressed_blob sizeBytes = 3982209 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

•path = Binaries/Jvm/hypertube-java-core.jar kind = nested_archive_needs_inspection sizeBytes = 3982209 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "hypertube-binaries",

3 "version": "3.1.12",

4 "description": "Hypertube allows you to reference and use modules or packages written in (Java/Kotlin/Groovy/Clojure, C#/VB.NET, Ruby, Perl, Python, JavaScript/TypeScript) like they were created in your technology. It works on Linux/Windows and MacOS for applications created in JVM, CLR/Netcore, Perl, Python, Ruby, NodeJS, C++ or GoLang and gives you unparalleled freedom and flexibility with native performance in building your mixed-technologies products. Let it be accessing best AI or cryptography libraries, devices SDKs, legacy client modules, internal custom packages or anything from pu ...

5 "main": "index.js",

6 "type": "commonjs",

7 "keywords": [],

8 "author": "Graftcode S.A.",

9 "license": "ISC",

10 "scripts": {

11 "install": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "prebuild": "node-gyp rebuild",

13 "build:win32": "node-gyp rebuild --target_arch=x64",

14 "build:win32:arm64": "node-gyp rebuild --target_arch=arm64",

15 "build:linux": "node-gyp rebuild --target_arch=x64",

16 "build:linux:arm64": "node-gyp rebuild --target_arch=arm64",

17 "build:darwin": "node-gyp rebuild --target_arch=x64",

18 "build:darwin:arm64": "node-gyp rebuild --target_arch=arm64",

19 "package:prebuild": "node scripts/package-prebuild.js",

20 "verify": "node scripts/verify-prebuild.js"

21 },

22 "os": [

23 "win32",

24 "linux",

25 "darwin"

26 ],

27 "cpu": [

28 "x64",

29 "arm64"

30 ],

31 "devDependencies": {

Long lines were clipped for display.

index.jsView file

Lines 1-21javascript

1const path = require('path');

2const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

3const

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView file

•path = [redacted].dylib kind = native_binary sizeBytes = 290176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 709 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Binaries/Jvm/hypertube-java-core.jarView file

•path = Binaries/Jvm/hypertube-java-core.jar kind = high_entropy_blob sizeBytes = 3982209 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

•path = Binaries/Jvm/hypertube-java-core.jar kind = compressed_blob sizeBytes = 3982209 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

•path = Binaries/Jvm/hypertube-java-core.jar kind = nested_archive_needs_inspection sizeBytes = 3982209 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg