node-config-normalizer@1.0.0
Normalize configuration objects coming from environment, files, and CLI flags.
AI Security Review
scanned 20h ago · by lpm-firewall-aiThe package’s postinstall hook automatically contacts an unrelated beacon endpoint, behavior unrelated to its stated configuration-normalization purpose. The inspected request carries no explicit data, so this is install_hook_abuse rather than data exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the postinstall script without an explicit user request.
Impact
The request contacts an unrelated collector during installation; the inspected code sends no explicit payload.
Mechanism
scripts/install.js calls beacon.emit, which issues an HTTPS GET to https://my-contolled-backend/beacon.
Attack narrative
On installation, the postinstall hook calls a beacon function that issues an HTTPS GET to a concealed, unrelated host. The request sends no explicit payload in the inspected source, but the unsolicited install-time contact is unrelated to the package’s configuration utility and matches install_hook_abuse.
AI rationale
The package’s postinstall hook automatically contacts an unrelated beacon endpoint, behavior unrelated to its stated configuration-normalization purpose. The inspected request carries no explicit data, so this is install_hook_abuse rather than data exfiltration.
Evidence
package.jsonscripts/install.jslib/beacon.js
Network endpoints1
my-contolled-backend/beacon
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs scripts/install.js automatically through a postinstall hook.
- The install hook calls beacon.emit, which makes an HTTPS GET request to https://my-contolled-backend/beacon.
- The beacon hostname is assembled from split string fragments, and the request is unrelated to configuration normalization.
- The package README describes a configuration merging utility; the install request carries no package feature data in the inspected source.
Evidence against
- The beacon request sends no explicit payload in the inspected source.
- The main entry point implements recursive object merging and does not initiate network activity.
Behavioral surface
Network
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg12"postinstall": "node scripts/install.js"
},
"keywords": [
"config",
"normalize",
"settings",
"env"
],
"license": "MIT",
"engines": {
"node": ">=14"
High
Suspicious Lifecycle Evidence
The package runs scripts/install.js automatically through a postinstall hook.
package.jsonView on unpkg · L12•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/beacon.jsView file
Findings
5 High2 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencelib/beacon.js
HighAi Review Evidencelib/beacon.js
HighAi Review EvidenceREADME.md
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to node-config-normalizer@1.0.0.
See all versions of node-config-normalizer for other recorded verdicts.
- Avoid installing node-config-normalizer@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.