registry / npx-oob-package / 1.0.2

npx-oob-package@1.0.2

Minimal npx package that POSTs package name and whoami to an OOB callback

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Running the CLI transmits local identity and host fingerprint data to a hard-coded third-party callback. The request is concealed by swallowing failures.

Static reason

One or more suspicious static signals were detected.

Trigger

An explicit invocation of the npx-oob-package CLI.

Impact

Discloses the executing account name, hostname, platform, and package name to the callback operator.

Mechanism

Host fingerprint collection and external POST exfiltration.

Attack narrative

When invoked, the CLI determines the current account name and gathers hostname and platform details. It submits those values in a POST request to a hard-coded external callback. The package does not provide a local function beyond this reporting behavior, and it suppresses request errors, making the disclosure unobvious to the user.

Rationale

The package's implemented behavior is an external transfer of local identity and host data to an unrelated hard-coded endpoint. Explicit CLI invocation does not make this covert fingerprint exfiltration package-aligned.

Evidence

bin/cli.jspackage.json

Network endpoints1

oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence with false-positive risk.

npx-oob-package@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code