registry / mx-www-app-lib1 / 1.0.0

mx-www-app-lib1@1.0.0

Security placeholder to prevent dependency confusion on mx-www-app-lib1. Published by diosikigai for BugRap PoC.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Installing the package automatically collects local host and environment context and drops it into a temp file. No outbound endpoint is present.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, via postinstall

Impact

Creates an unconsented host-information artifact during dependency installation.

Mechanism

install-time host metadata collection and temp-file write

Attack narrative

The postinstall hook runs automatically during npm installation, reads host and environment-derived metadata, and writes it to a predictable file in the operating-system temp directory. Although this source contains no network transmission, the collection and artifact creation are unconsented install-time behavior consistent with a dependency-confusion proof-of-concept.

Rationale

Source inspection confirms concrete install-time collection and local persistence rather than a scanner-only match. The absence of networking limits impact but does not remove the unconsented behavior.

Evidence

package.jsonindex.jsos.tmpdir()/mexc-confirmation-dios.txt

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

mx-www-app-lib1@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code