registry / Malware / inadequate_earwig_magenta-66

inadequate_earwig_magenta-66

Ini adalah script Node.js yang bisa auto ganti nama package dalam file `package.json` dan `package-lock.json`, serta bisa publish package ke npmjs.com dengan`npm publish`. Script ini memiliki jeda waktu 1-5 menit untuk publish package selanjutnya. Sambil

This report shows the evidence for inadequate_earwig_magenta-66@3.4.3, the only known version.

AI Security Review

scanned 10h ago · by lpm-firewall-ai

The package's main entrypoint automatically alters package metadata and publishes publicly, then repeats the action on a timer. Although the README documents running the script directly, the same behavior is reachable simply by importing the package.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing the package through its main entrypoint, or running autopublish.js directly.

Impact

Can publish the user's project under randomly generated package names and continue publishing without a separate confirmation for each run.

Mechanism

Top-level code changes package metadata, invokes npm publish --access public, and schedules further publishing.

Attack narrative

The main entrypoint immediately renames the current project, publishes it publicly with npm, and schedules another publish; importing this package can therefore trigger repeated publishing under the user's npm credentials.

AI rationale

Evidence

package.jsonautopublish.jsREADME.mdpackage-lock.json

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The package declares autopublish.js as its main entrypoint.
At module load, autopublish.js immediately starts its publishing routine.
The routine changes the current package name to a randomly generated name and writes package.json and package-lock.json.
It runs npm publish --access public, then schedules another publish after a delay.

Evidence against

The README describes the project as an auto-publishing script and documents running it explicitly with node autopublish.js.
The manifest declares no install or postinstall lifecycle script.

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 14.2 KB of source

Source & flagged code

7 flagged

autopublish.jsView file

1const fs = require('fs'); L2: const { exec } = require('child_process'); L3: ... L28: const animationInterval = setInterval(() => { L29: process.stdout.write('\r' + animation[currentFrame]); L30: currentFrame = (currentFrame + 1) % animation.length; ... L32: L33: let packageJson = fs.readFileSync('package.json'); L34: let packageData = JSON.parse(packageJson); L35: let randomString = generateRandomString(10); ... L45: L46: exec('npm publish --access public', (error, stdout, stderr) => {

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

autopublish.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> autopublish.js L1: const fs = require('fs'); L2: const { exec } = require('child_process'); L3: ... L28: const animationInterval = setInterval(() => { L29: process.stdout.write('\r' + animation[currentFrame]); L30: currentFrame = (currentFrame + 1) % animation.length; ... L32: L33: let packageJson = fs.readFileSync('package.json'); L34: let packageData = JSON.parse(packageJson); L35: let randomString = generateRandomString(10); ... L45: L46: exec('npm publish --access public', (error, stdout, stderr) => {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

autopublish.jsView on unpkg · L1

1const fs = require('fs'); L2: const { exec } = require('child_process'); L3:

High

Child Process

Package source references child process execution.

autopublish.jsView on unpkg · L1

64} publishWithDelay();

High

Ai Review Evidence

At module load, autopublish.js immediately starts its publishing routine.

autopublish.jsView on unpkg · L64

33let packageJson = fs.readFileSync('package.json'); let packageData = JSON.parse(packageJson); let randomString = generateRandomString(10); packageData.name = `${randomString}-notthedevs`; //bisa ganti "-notthedevs" dengan apapun fs.writeFileSyn

High

Ai Review Evidence

The routine changes the current package name to a randomly generated name and writes package.json and package-lock.json.

autopublish.jsView on unpkg · L33

autopublish3.jsView file

•matchType = malicious_source_fingerprint_signature signature = 49b7c8d728f416b2 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = valid_antlion_amber-50@4.1.3 matchedPath = autopublish3.js matchedIdentity = npm:dmFsaWRfYW50bGlvbl9hbWJlci01MA:4.1.3 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

autopublish3.jsView on unpkg

package.jsonView file

5"main": "autopublish.js", "scripts": { "test": "echo \"Error:

High

Ai Review Evidence

The package declares autopublish.js as its main entrypoint.

package.jsonView on unpkg · L5

Findings

2 Critical6 High1 Medium3 Low

CriticalNpm Publish Wormautopublish.js

CriticalTrigger Reachable Dangerous Capabilityautopublish.js

HighChild Processautopublish.js

HighShell

HighKnown Malware Source Fingerprint Signatureautopublish3.js

HighAi Review Evidencepackage.json

HighAi Review Evidenceautopublish.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to inadequate_earwig_magenta-66@3.4.3.

The versions list below shows the verdict for each recorded version.

Avoid installing inadequate_earwig_magenta-66@3.4.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-04 09:49:15.321Z (UTC).

Source advisory published: 2026-11-02 09:44:21.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

3.4.3latestshownMaliciousMalwareBlockPublishedMay 21, 2024, 5:22 PM

registry / Malware / inadequate_earwig_magenta-66

inadequate_earwig_magenta-66

This report shows the evidence for inadequate_earwig_magenta-66@3.4.3, the only known version.

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing the package through its main entrypoint, or running autopublish.js directly.

Impact

Can publish the user's project under randomly generated package names and continue publishing without a separate confirmation for each run.

Mechanism

Top-level code changes package metadata, invokes npm publish --access public, and schedules further publishing.

Attack narrative

AI rationale

Evidence

package.jsonautopublish.jsREADME.mdpackage-lock.json

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The package declares autopublish.js as its main entrypoint.
At module load, autopublish.js immediately starts its publishing routine.
The routine changes the current package name to a randomly generated name and writes package.json and package-lock.json.
It runs npm publish --access public, then schedules another publish after a delay.

Evidence against

The README describes the project as an auto-publishing script and documents running it explicitly with node autopublish.js.
The manifest declares no install or postinstall lifecycle script.

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 14.2 KB of source

Source & flagged code

7 flagged

autopublish.jsView file

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

autopublish.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

autopublish.jsView on unpkg · L1

1const fs = require('fs'); L2: const { exec } = require('child_process'); L3:

High

Child Process

Package source references child process execution.

autopublish.jsView on unpkg · L1

64} publishWithDelay();

High

Ai Review Evidence

At module load, autopublish.js immediately starts its publishing routine.

autopublish.jsView on unpkg · L64

High

Ai Review Evidence

The routine changes the current package name to a randomly generated name and writes package.json and package-lock.json.

autopublish.jsView on unpkg · L33

autopublish3.jsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

autopublish3.jsView on unpkg

package.jsonView file

5"main": "autopublish.js", "scripts": { "test": "echo \"Error:

High

Ai Review Evidence

The package declares autopublish.js as its main entrypoint.

package.jsonView on unpkg · L5

Findings

2 Critical6 High1 Medium3 Low

CriticalNpm Publish Wormautopublish.js

CriticalTrigger Reachable Dangerous Capabilityautopublish.js

HighChild Processautopublish.js

HighShell

HighKnown Malware Source Fingerprint Signatureautopublish3.js

HighAi Review Evidencepackage.json

HighAi Review Evidenceautopublish.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to inadequate_earwig_magenta-66@3.4.3.

The versions list below shows the verdict for each recorded version.

Avoid installing inadequate_earwig_magenta-66@3.4.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-04 09:49:15.321Z (UTC).

Source advisory published: 2026-11-02 09:44:21.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

3.4.3latestshownMaliciousMalwareBlockPublishedMay 21, 2024, 5:22 PM

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages