registry / mx-biz-hot / 1.0.0

mx-biz-hot@1.0.0

Security placeholder to prevent dependency confusion on mx-biz-hot. Published by diosikigai for BugRap PoC.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Installing the package runs an inline postinstall command that collects local host metadata and drops it into a temporary file. No network transmission was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes postinstall.

Impact

Unconsented installation-time local data collection and filesystem mutation.

Mechanism

install-time host metadata collection and temporary-file write

Attack narrative

The package's postinstall hook executes Node code automatically during installation. It reads host and environment-derived metadata, including username and working directory, then writes it to a temporary file. Although no exfiltration was found, this is an unconsented install-time collection and filesystem-write payload, explicitly framed as a dependency-confusion PoC.

Rationale

Source inspection confirms the lifecycle payload and its local metadata collection/write behavior. The benign runtime entrypoint does not mitigate the install-time action.

Evidence

package.jsonindex.js%TEMP%/mexc-confirmation-dios.txt

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json postinstall runs automatically on installation.

mx-biz-hot@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code