Loading npm security reports…

hypertube-binaries@3.1.7: Malicious npm security report (Block) | LPM Firewall

registry / hypertube-binaries / 3.1.7

hypertube-binaries@3.1.7

Hypertube allows you to reference and use modules or packages written in (Java/Kotlin/Groovy/Clojure, C#/VB.NET, Ruby, Perl, Python, JavaScript/TypeScript) like they were created in your technology. It works on Linux/Windows and MacOS for applications cre

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At runtime, bundled SDK components exfiltrate exception messages, hostname, OS, and license key as telemetry. This does not run during npm install, but is triggered by SDK exception paths.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime exception while using the bundled Python, PHP, or Ruby SDK components.

Impact

Sensitive exception content and licensing/host identifiers can be disclosed to a fixed third-party endpoint.

Mechanism

Exception telemetry POST containing host and license metadata.

Attack narrative

The package bundles SDK runtime code that automatically reports exceptions to a fixed Application Insights endpoint. The report includes the host name, OS, license key, and exception-derived message, which can contain application details. The npm install hook itself only selects or compiles a native addon, but the bundled cross-runtime components create a concrete unconsented runtime data-exfiltration path.

Rationale

Source establishes an automatic fixed-endpoint telemetry path carrying license and host identifiers plus exception content. The benign native-addon install behavior does not remove this runtime exfiltration risk.

Evidence

Binaries/Python/hypertube/utils/messageHelper/MessageHelper.pyBinaries/Python/hypertube/utils/exception/ExceptionThrower.pyscripts/install.jsindex.js

Network endpoints1

dc.services.visualstudio.com/v2/track

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.install = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

1const path = require('path'); L2: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView file

•path = [redacted].dylib kind = native_binary sizeBytes = 275352 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 709 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Binaries/Jvm/HypertubeJvmRuntime.jarView file

•path = [redacted].jar kind = high_entropy_blob sizeBytes = 5665954 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Binaries/Jvm/HypertubeJvmRuntime.jarView on unpkg

•path = [redacted].jar kind = compressed_blob sizeBytes = 5665954 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Binaries/Jvm/HypertubeJvmRuntime.jarView on unpkg

•path = [redacted].jar kind = nested_archive_needs_inspection sizeBytes = 5665954 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Binaries/Jvm/HypertubeJvmRuntime.jarView on unpkg

Binaries/Python/hypertube/utils/messageHelper/MessageHelper.pyView file

29APP_INSIGHTS_TRACK_URL = "https://dc.services.visualstudio.com/v2/track" REQUEST_TIMEOUT_SECONDS = 3 INSTRUMENTATION_KEY = ( os.environ.get("HYPERTUBE_INSTRUMENTATION_KEY") or "2c751560-90c8-40e9-b5dd-534566514723" )

High

Ai Review Evidence

Bundled Python runtime posts exception telemetry to a fixed external endpoint.

Binaries/Python/hypertube/utils/messageHelper/MessageHelper.pyView on unpkg · L29

Source & flagged code

9 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "hypertube-binaries",

3 "version": "3.1.7",

4 "description": "Hypertube allows you to reference and use modules or packages written in (Java/Kotlin/Groovy/Clojure, C#/VB.NET, Ruby, Perl, Python, JavaScript/TypeScript) like they were created in your technology. It works on Linux/Windows and MacOS for applications created in JVM, CLR/Netcore, Perl, Python, Ruby, NodeJS, C++ or GoLang and gives you unparalleled freedom and flexibility with native performance in building your mixed-technologies products. Let it be accessing best AI or cryptography libraries, devices SDKs, legacy client modules, internal custom packages or anything from pu ...

5 "main": "index.js",

6 "type": "commonjs",

7 "keywords": [],

8 "author": "Graftcode S.A.",

9 "license": "ISC",

10 "scripts": {

11 "install": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "prebuild": "node-gyp rebuild",

13 "build:win32": "node-gyp rebuild --target_arch=x64",

14 "build:win32:arm64": "node-gyp rebuild --target_arch=arm64",

15 "build:linux": "node-gyp rebuild --target_arch=x64",

16 "build:linux:arm64": "node-gyp rebuild --target_arch=arm64",

17 "build:darwin": "node-gyp rebuild --target_arch=x64",

18 "build:darwin:arm64": "node-gyp rebuild --target_arch=arm64",

19 "package:prebuild": "node scripts/package-prebuild.js",

20 "verify": "node scripts/verify-prebuild.js"

21 },

22 "os": [

23 "win32",

24 "linux",

25 "darwin"

26 ],

27 "cpu": [

28 "x64",

29 "arm64"

30 ],

31 "devDependencies": {

Long lines were clipped for display.

index.jsView file

Lines 1-21javascript

1const path = require('path');

2const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

3const

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView file

•path = [redacted].dylib kind = native_binary sizeBytes = 275352 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Binaries/Native/MacOs/X64/libHypertubeNodejsRuntimeNative.dylibView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 709 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Binaries/Jvm/HypertubeJvmRuntime.jarView file

•path = [redacted].jar kind = high_entropy_blob sizeBytes = 5665954 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Binaries/Jvm/HypertubeJvmRuntime.jarView on unpkg

•path = [redacted].jar kind = compressed_blob sizeBytes = 5665954 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Binaries/Jvm/HypertubeJvmRuntime.jarView on unpkg

•path = [redacted].jar kind = nested_archive_needs_inspection sizeBytes = 5665954 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Binaries/Jvm/HypertubeJvmRuntime.jarView on unpkg

Binaries/Python/hypertube/utils/messageHelper/MessageHelper.pyView file

Lines 9-49text

9import urllib.error

10import json

11

12from hypertube.utils.UtilsConst import UtilsConst

13

14

15def __get_host_name():

16 try:

17 return socket.gethostname()

18 except socket.error:

19 return "Unknown Host"

20

21