Loading npm security reports…

mt-tech: Malicious npm security report (Block) | LPM Firewall

registry / mt-tech / 1.0.12

mt-tech@1.0.12

美团技术服务合作中心通用cli

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Running the mt-tech CLI imports a bundled, obfuscated guard that alters HTTP handling and launches a recurring daemon. The daemon checks for remote updates and can process downloaded files.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the mt-tech command.

Impact

The package can persist outside the requested CLI operation and alter network behavior in the invoking process.

Mechanism

The launcher imports CLIGuard at startup; the guard hooks HTTP requests, starts a background daemon, and polls for updates.

Attack narrative

The CLI silently imports an obfuscated bundled dependency before command execution. That dependency hooks HTTP requests, starts a persistent daemon, polls for updates, and contains child-process execution support. These unrelated, concealed behaviors create an active persistence and network-control surface.

AI rationale

The hidden import-time request interception, recurring daemon, and remote update mechanism are unrelated to a general CLI and are concealed by obfuscation. This is concrete malicious persistence behavior.

Evidence

package.jsonbin/run.jsnode_modules/@sec/cliguard/index.jsnode_modules/@sec/cliguard/core/cliguard-wrapper.jsnode_modules/@sec/cliguard/core/cliguard.js

Decision evidence

public snapshot

Source & flagged code

6 flagged · loading source

node_modules/@sec/cliguard/index.jsView file

•matchType = normalized_sha256 matchedPackage = mt-tech@1.0.11 matchedPath = node_modules/@sec/cliguard/index.js matchedIdentity = npm:bXQtdGVjaA:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@sec/cliguard/index.jsView on unpkg

1#!/usr/bin/env node L2: 'use strict';const a0_0x11efc4=a0_0x4101;(function(_0x591981,_0x3efe69){const _0xb13700=a0_0x4101,_0x55b286=_0x591981();while(!![]){try{const _0x4d9799=parseInt(_0xb13700(0x137))/0...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

node_modules/@sec/cliguard/index.jsView on unpkg · L1

dist/index.jsView file

1(function(_0x3ed667,_0x22d19d){var _0x88a4be=_0x22f6,_0x55e0ac=_0x3ed667();while(!![]){try{var _0xf58151=parseInt(_0x88a4be(0x15e))/0x1+parseInt(_0x88a4be(0x162))/0x2*(parseInt(_0x...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

bin/dev.cmdView file

•path = bin/dev.cmd kind = build_helper sizeBytes = 86 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/dev.cmdView on unpkg

node_modules/@sec/cliguard/core/cliguard.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/@sec/cliguard/core/cliguard.js#virtual:normalized:round1View on unpkg

node_modules/@sec/cliguard/core/cliguard-wrapper.jsView file

•matchType = normalized_sha256 matchedPackage = mt-tech@1.0.11 matchedPath = node_modules/@sec/cliguard/core/cliguard-wrapper.js matchedIdentity = npm:bXQtdGVjaA:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@sec/cliguard/core/cliguard-wrapper.jsView on unpkg

Source & flagged code

6 flagged

node_modules/@sec/cliguard/index.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';const a0_0x11efc4=a0_0x4101;(function(_0x591981,_0x3efe69){const _0xb13700=a0_0x4101,_0x55b286=_0x591981();while(!![]){try{const _0x4d9799=parseInt(_0xb13700(0x137))/0x1*(-parseInt(_0xb13700(0x148))/0x2)+parseInt(_0xb13700(0x18d))/0x3+-parseInt(_0xb13700(0x149))/0x4+-parseInt(_0xb13700(0x196))/0x5+parseInt(_0xb13700(0x165))/0x6*(parseInt(_0xb13700(0x1a5))/0x7)+parseInt(_0xb13700(0x161))/0x8*(-parseInt(_0xb13700(0x1a4))/0x9)+parseInt(_0xb13700(0x17f))/0xa*(parseInt(_0xb13700(0x151))/0xb);if(_0x4d9799===_0x3efe69)break;else _0x55b286['push'](_0x55b286['shift']());}catch(_0x97dd3a){_ ...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

node_modules/@sec/cliguard/index.jsView on unpkg · L1

Long lines were clipped for display.

•matchType = normalized_sha256 matchedPackage = mt-tech@1.0.11 matchedPath = node_modules/@sec/cliguard/index.js matchedIdentity = npm:bXQtdGVjaA:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@sec/cliguard/index.jsView on unpkg

dist/index.jsView file

Lines 1-1javascript

1(function(_0x3ed667,_0x22d19d){var _0x88a4be=_0x22f6,_0x55e0ac=_0x3ed667();while(!![]){try{var _0xf58151=parseInt(_0x88a4be(0x15e))

bin/dev.cmdView file

•path = bin/dev.cmd kind = build_helper sizeBytes = 86 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/dev.cmdView on unpkg

node_modules/@sec/cliguard/core/cliguard.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/@sec/cliguard/core/cliguard.js#virtual:normalized:round1View on unpkg

node_modules/@sec/cliguard/core/cliguard-wrapper.jsView file

•matchType = normalized_sha256 matchedPackage = mt-tech@1.0.11 matchedPath = node_modules/@sec/cliguard/core/cliguard-wrapper.js matchedIdentity = npm:bXQtdGVjaA:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@sec/cliguard/core/cliguard-wrapper.jsView on unpkg