Loading npm security reports…

hypertube-binaries@3.1.13: Malicious npm security report (Block) | LPM Firewall

registry / hypertube-binaries / 3.1.13

hypertube-binaries@3.1.13

Hypertube allows you to reference and use modules or packages written in (Java/Kotlin/Groovy/Clojure, C#/VB.NET, Ruby, Perl, Python, JavaScript/TypeScript) like they were created in your technology. It works on Linux/Windows and MacOS for applications cre

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Runtime exception handling posts exception text, host details, and the configured licence key to an external telemetry service. Opaque native and JVM artifacts expand the unreviewable runtime surface.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

An SDK exception occurs during runtime.

Impact

A licence key, hostname, operating-system details, and exception contents can be disclosed externally.

Mechanism

Telemetry-based licence and error-data exfiltration.

Attack narrative

When the bundled SDK processes an exception, it calls its telemetry helper. The helper builds a request containing the exception message, host name, operating system, calling runtime, and licence key, then posts it to an Azure Application Insights endpoint. This is an unconsented disclosure of a credential-like value and runtime data. The package also ships opaque native and JVM binaries, so their behaviour cannot reduce that demonstrated source-level risk.

AI rationale

Visible source establishes automatic external transmission of licence and exception data. This is concrete data exfiltration, independent of the opaque binary components.

Evidence

Binaries/Python/hypertube/utils/messageHelper/MessageHelper.pyBinaries/Python/hypertube/utils/exception/ExceptionThrower.py

Network endpoints1

polandcentral-0.in.applicationinsights.azure.com/v2/track

Decision evidence

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.install = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

•matchType = malicious_source_fingerprint_signature signature = 779090be4bdf377b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hypertube-binaries@3.1.7 matchedPath = index.js matchedIdentity = npm:aHlwZXJ0dWJlLWJpbmFyaWVz:3.1.7 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

1const path = require('path'); L2: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView file

•path = [redacted].dylib kind = native_binary sizeBytes = 290176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 709 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Binaries/Jvm/hypertube-java-core.jarView file

•path = Binaries/Jvm/hypertube-java-core.jar kind = high_entropy_blob sizeBytes = 3982209 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

•path = Binaries/Jvm/hypertube-java-core.jar kind = compressed_blob sizeBytes = 3982209 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

•path = Binaries/Jvm/hypertube-java-core.jar kind = nested_archive_needs_inspection sizeBytes = 3982209 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "hypertube-binaries",

3 "version": "3.1.13",

4 "description": "Hypertube allows you to reference and use modules or packages written in (Java/Kotlin/Groovy/Clojure, C#/VB.NET, Ruby, Perl, Python, JavaScript/TypeScript) like they were created in your technology. It works on Linux/Windows and MacOS for applications created in JVM, CLR/Netcore, Perl, Python, Ruby, NodeJS, C++ or GoLang and gives you unparalleled freedom and flexibility with native performance in building your mixed-technologies products. Let it be accessing best AI or cryptography libraries, devices SDKs, legacy client modules, internal custom packages or anything from pu ...

5 "main": "index.js",

6 "type": "commonjs",

7 "keywords": [],

8 "author": "Graftcode S.A.",

9 "license": "ISC",

10 "scripts": {

11 "install": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "prebuild": "node-gyp rebuild",

13 "build:win32": "node-gyp rebuild --target_arch=x64",

14 "build:win32:arm64": "node-gyp rebuild --target_arch=arm64",

15 "build:linux": "node-gyp rebuild --target_arch=x64",

16 "build:linux:arm64": "node-gyp rebuild --target_arch=arm64",

17 "build:darwin": "node-gyp rebuild --target_arch=x64",

18 "build:darwin:arm64": "node-gyp rebuild --target_arch=arm64",

19 "package:prebuild": "node scripts/package-prebuild.js",

20 "verify": "node scripts/verify-prebuild.js"

21 },

22 "os": [

23 "win32",

24 "linux",

25 "darwin"

26 ],

27 "cpu": [

28 "x64",

29 "arm64"

30 ],

31 "devDependencies": {

Long lines were clipped for display.

index.jsView file

Lines 1-21javascript

1const path = require('path');

2const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

3const

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView file

•path = [redacted].dylib kind = native_binary sizeBytes = 290176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 709 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Binaries/Jvm/hypertube-java-core.jarView file

•path = Binaries/Jvm/hypertube-java-core.jar kind = high_entropy_blob sizeBytes = 3982209 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

•path = Binaries/Jvm/hypertube-java-core.jar kind = compressed_blob sizeBytes = 3982209 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

•path = Binaries/Jvm/hypertube-java-core.jar kind = nested_archive_needs_inspection sizeBytes = 3982209 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Binaries/Jvm/hypertube-java-core.jarView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg