registry / Data exfiltration / merchantprefsservice-paypal
merchantprefsservice-paypal
Dependency confusion proof of concept package
This report shows the evidence for merchantprefsservice-paypal@28.0.0. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms unconsented install-time collection and exfiltration of host fingerprint data. This is concrete malicious behavior, not merely a static indicator.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm preinstall during installation
Impact
Leaks local host identity, home-directory path, and configured DNS resolvers.
Mechanism
install-time host fingerprinting and HTTPS exfiltration
Attack narrative
npm invokes the preinstall hook, which runs index.js without user interaction. The script gathers host and network-identifying metadata and sends it in an HTTPS POST to an external OAST host.
AI rationale
Direct source inspection confirms unconsented install-time collection and exfiltration of host fingerprint data. This is concrete malicious behavior, not merely a static indicator.
Evidence
package.jsonindex.jsmerchantprefsservice-paypal-28.0.0.tgz
Network endpoints1
fdw2vnyonnpdk7x3ntotw7omtdz5n4bt.oastify.com/hit
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs `node index.js` via preinstall.
- index.js collects hostname, platform, architecture, home directory, and DNS servers.
- index.js POSTs the collected JSON to fdw2vnyonnpdk7x3ntotw7omtdz5n4bt.oastify.com/hit.
- Bundled archive contains the same lifecycle manifest and entrypoint.
Evidence against
- No additional payload, shell execution, or persistence was found in inspected files.
Behavioral surface
Network
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
1const https = require("https");
L2: const os = require("os");
L3: const dns = require("dns");
L4:
L5: const data = JSON.stringify({
L6: hostname: os.hostname(),
L7: platform: os.platform(),
...
L26:
L27: req.write(data);
L28: req.end();
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
index.jsView on unpkg · L1•matchType = malicious_source_fingerprint_signature
signature = 55ef5c661ef1e2d6
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = identityscimapiserv@28.0.0
matchedPath = index.js
matchedIdentity = npm:aWRlbnRpdHlzY2ltYXBpc2Vydg:28.0.0
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
Findings
3 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumShips Compressed Blobmerchantprefsservice-paypal-28.0.0.tgz
LowScripts Present
LowNested Archive Needs Inspectionmerchantprefsservice-paypal-28.0.0.tgz
LowNo License
Affected versions and remediation
This report applies to merchantprefsservice-paypal@28.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing merchantprefsservice-paypal@28.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.