registry / Install hook abuse / nginxforge-panel
nginxforge-panel
Modern VPS Hosting Control Panel with Automated Nginx, Zero-Downtime Deployments, Let's Encrypt TLS, Multi-Tenant Database Management, and AI Copilot.
This report shows the evidence for nginxforge-panel@1.1.6. 5 of 9 known versions are blocked or flagged. The newest version, 1.1.7, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe install-time hook performs broad host package installation rather than limiting itself to package-local setup. The behavior is activated automatically by npm installation and can invoke sudo.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation with lifecycle scripts enabled in an interactive terminal
Impact
It can alter the host by installing packages and invoking sudo without a separately requested setup command.
Mechanism
postinstall launches a privileged system package installer
Attack narrative
The package registers a postinstall hook. During an interactive npm install, that hook runs its system installer automatically. The installer selects missing tools by default, can accept missing-tool installation without interaction in non-interactive execution, and executes the detected operating-system package manager through sudo when needed. This makes ordinary dependency installation capable of modifying the host and installing server software.
AI rationale
The install-time hook performs broad host package installation rather than limiting itself to package-local setup. The behavior is activated automatically by npm installation and can invoke sudo.
Evidence
package.jsonscripts/postinstall.mjsscripts/system-installer.mjs
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest automatically runs a postinstall script.
- On an interactive install, the postinstall script starts the system installer.
- The installer treats missing tools as approved in non-interactive mode and defaults interactive missing-tool prompts to yes.
- The installer invokes the host package manager, using sudo when it is not root.
Evidence against
- The postinstall script does not launch the installer when stdout is not a terminal.
- No credential harvesting or outbound endpoint is involved in the install-time path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Oversized source lightweight scan
dist/index.js2.90 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsEvalDynamicRequirePossibleObfuscationHighEntropyStringsUrlStringsdeveloper.mozilla.orgdotenvx.comgit.iogithub.comstackoverflow.com
Source & flagged code
24 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/nginxforge.mjsView file
14import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
High
Child Process
Package source references child process execution.
bin/nginxforge.mjsView on unpkg · L1484} else {
L85: execSync(`sudo bash -c "cat << 'EOF' > ${serviceFile}\n${sContent}\nEOF\nsystemctl daemon-reload && systemctl enable nginxforge.service"`, { stdio: "ignore" });
L86: }
High
14Cross-file remote execution chain: bin/nginxforge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution.
L14: import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
L17: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L18: const ROOT_DIR = path.resolve(__dirname, "..");
...
L82: fs.writeFileSync(serviceFile, sContent, "utf8");
L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" });
L84: } else {
...
L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], {
L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" },
L122: stdio: "inherit",
...
L160: console.log(` ${token}`);
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/nginxforge.mjsView on unpkg · L1414Detached bundled service listener: bin/nginxforge.mjs spawns dist/index.js; helper exposes a broad-bound HTTP listener.
L14: import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
L17: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L18: const ROOT_DIR = path.resolve(__dirname, "..");
...
L82: fs.writeFileSync(serviceFile, sContent, "utf8");
L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" });
L84: } else {
...
L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], {
L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" },
L122: stdio: "inherit",
...
L160: console.log(` ${token}`);
High
Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
bin/nginxforge.mjsView on unpkg · L14•matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.5
matchedPath = bin/nginxforge.mjs
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/nginxforge.mjsView on unpkg14import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
L17: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L18: const ROOT_DIR = path.resolve(__dirname, "..");
...
L82: fs.writeFileSync(serviceFile, sContent, "utf8");
L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" });
L84: } else {
...
L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], {
L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" },
L122: stdio: "inherit",
...
L160: console.log(` ${token}`);
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/nginxforge.mjsView on unpkg · L14dist/index.jsView file
40L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json
L42: var require_package = __commonJS({
...
L76: },
L77: homepage: "https://github.com/motdotla/dotenv#readme",
L78: funding: "https://dotenvx.com",
...
L145: function supportsAnsi() {
L146: return process.stdout.isTTY;
L147: }
...
L176: if (!result.parsed) {
L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L178: err.code = "MISSING_DATA";
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/index.jsView on unpkg · L4040Trigger-reachable chain: scripts.start -> dist/index.js
L40:
L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json
L42: var require_package = __commonJS({
...
L76: },
L77: homepage: "https://github.com/motdotla/dotenv#readme",
L78: funding: "https://dotenvx.com",
...
L145: function supportsAnsi() {
L146: return process.stdout.isTTY;
L147: }
...
L176: if (!result.parsed) {
L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L178: err.code = "MISSING_DATA";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L40•matchType = previous_version_dangerous_delta
matchedPackage = nginxforge-panel@1.0.4
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.4
similarity = 0.983
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var parentUrl = req.baseUrl || "";
var done = restore(out, req, "baseUrl", "next", "params");
req.baseUrl = parentUrl;
req.baseUrl = parentUrl;
req.baseUrl = parentUrl + (removed[removed.length - 1] === "/" ? removed.substring(0, removed.length - 1) : removed);
removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
databaseUrl: process.env.DATABASE_URL ?? "",
headers: { Authorization: `Bearer ${ENV.forgeApiKey}` }
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg316try {
L317: const parsed = DotenvModule.parse(fs24.readFileSync(path21, { encoding }));
L318: DotenvModule.populate(parsedAll, parsed, options);
...
L18355: var parentParams = req.params;
L18356: var parentUrl = req.baseUrl || "";
L18357: var done = restore(out, req, "baseUrl", "next", "params");
...
L59398: gitArgs.push(cleanUrl, tmpFolder);
L59399: const { execFileSync: execFileSync11 } = await import("node:child_process");
L59400: execFileSync11("git", gitArgs, { timeout: 35e3 });
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.jsView on unpkg · L31640Trigger-reachable persistence chain: scripts.start -> dist/index.js
L40:
L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json
L42: var require_package = __commonJS({
...
L76: },
L77: homepage: "https://github.com/motdotla/dotenv#readme",
L78: funding: "https://dotenvx.com",
...
L145: function supportsAnsi() {
L146: return process.stdout.isTTY;
L147: }
...
L176: if (!result.parsed) {
L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L178: err.code = "MISSING_DATA";
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L40•matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.5
matchedPath = dist/index.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = af420a72f1e4dc81
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = nginxforge-panel@1.1.5
matchedPath = dist/index.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.5
similarity = 1.000
shingleOverlap = 62
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.jsView on unpkg1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
L2: var __create = Object.create;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L1703site.name = fn.name;
L704: var deprecatedfn = new Function(
L705: "fn",
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/index.jsView on unpkg · L703install.shView file
•path = install.sh
kind = build_helper
sizeBytes = 6069
magicHex = [redacted]
Medium
scripts/postinstall.mjsView file
•matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.5
matchedPath = scripts/postinstall.mjs
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.mjsView on unpkgscripts/system-installer.mjsView file
•matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.5
matchedPath = scripts/system-installer.mjs
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/system-installer.mjsView on unpkgdist/public/assets/cytoscape.esm-DtBltrT8.jsView file
•matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.5
matchedPath = dist/public/assets/cytoscape.esm-DtBltrT8.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkgdist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView file
•matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.5
matchedPath = dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView on unpkgdist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView file
•matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.5
matchedPath = dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView on unpkgFindings
3 Critical16 High7 Medium7 Low
CriticalPersistence Backdoordist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/nginxforge.mjs
HighShellbin/nginxforge.mjs
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextbin/nginxforge.mjs
HighSpawned Bundled Service Listenerbin/nginxforge.mjs
HighTrigger Reachable Persistencedist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritybin/nginxforge.mjs
HighKnown Malware Source Similarityscripts/postinstall.mjs
HighKnown Malware Source Similarityscripts/system-installer.mjs
HighKnown Malware Source Similaritydist/public/assets/cytoscape.esm-DtBltrT8.js
HighKnown Malware Source Similaritydist/public/assets/diagram-PSM6KHXK-DVKN-u96.js
HighKnown Malware Source Similaritydist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/nginxforge.mjs
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to nginxforge-panel@1.1.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing nginxforge-panel@1.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
9 known versions1.1.7latestSuspiciousInstall Hook AbuseWarnPublishedSep 4, 2026, 3:23 AM1.1.6shownMaliciousInstall Hook AbuseBlockPublishedSep 4, 2026, 2:59 AM1.1.5MaliciousInstall Hook AbuseBlockPublishedSep 2, 2026, 5:27 AM1.0.5MaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 12:02 PM1.0.4SuspiciousInstall Hook AbuseWarnPublishedSep 1, 2026, 11:34 AM1.0.3MaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 11:11 AM1.0.2SuspiciousInstall Hook AbuseWarnPublishedSep 1, 2026, 10:52 AM1.0.1SuspiciousInstall Hook AbuseWarnPublishedSep 1, 2026, 10:03 AM1.0.0MaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 7:35 AM