registry / mx-www-app-lib2 / 1.0.0

mx-www-app-lib2@1.0.0

Security placeholder to prevent dependency confusion on mx-www-app-lib2. Published by diosikigai for BugRap PoC.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Installing the package automatically collects local host and environment metadata, then writes it to a temporary file. This occurs without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation

Impact

Unconsented collection and local disclosure/persistence of hostname, username, working directory, platform, and timestamp.

Mechanism

install-time host metadata collection and temporary-file write

Attack narrative

On npm installation, the postinstall inline Node command reads host and process context values and writes them to mexc-confirmation-dios.txt in the OS temporary directory. The package labels itself as a dependency-confusion proof of concept. No network exfiltration was found, but the unsolicited install-time metadata collection and filesystem mutation are concrete malicious behavior.

Rationale

Direct inspection confirms an automatic postinstall collector and file write; the benign runtime entrypoint does not mitigate that install-time behavior. No network transmission was found.

Evidence

package.jsonindex.jsos.tmpdir()/mexc-confirmation-dios.txt

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

mx-www-app-lib2@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code