lumen-pages-community
Security research placeholder (dependency-confusion PoC). Benign, no data collected beyond a callback. Contact: sufiyan019 / HackerOne eufy_security.
This report shows the evidence for lumen-pages-community@9.9.9, the only known version.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-14356 confirms this npm version as malicious.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Concrete postinstall data collection and transmission establish malicious install-time exfiltration. The absence of file theft or persistence limits scope but does not negate the callback. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Independent scan evidence
public snapshot- postinstall executes dc.js automatically.
- dc.js collects host, user, cwd, platform, Node, CI flag, and npm user agent.
- Install hook sends the collected values to webhook.site.
- No file reads, shell execution, persistence, or secondary payload code found.
- DNS callback is disabled because DNS_LISTENER is empty.
Source & flagged code
4 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgpostinstall executes dc.js automatically.
package.jsonView on unpkg · L6dc.js collects host, user, cwd, platform, Node, CI flag, and npm user agent.
Findings
Affected versions and remediation
This report applies to lumen-pages-community@9.9.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing lumen-pages-community@9.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.