registry / Data exfiltration / paychex-pdftron
paychex-pdftron
This report shows the evidence for paychex-pdftron@99.9.1, the only known version.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe inspected source confirms automatic installation-time disclosure of identifying host and user data to a fixed collector. This is concrete data exfiltration, so the package is malicious.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing paychex-pdftron installs its remote ltidisafe dependency, whose preinstall hook runs test.js.
Impact
Installation exposes identifying machine and user data to the collector.
Mechanism
The hook hex-encodes the hostname, home directory, and username and embeds each value in an HTTP request to the collector.
Attack narrative
Installing the package installs a remote dependency with a preinstall hook. That hook collects the machine hostname, home directory, and username, encodes them, and sends them in requests to a fixed OAST collector.
AI rationale
The inspected source confirms automatic installation-time disclosure of identifying host and user data to a fixed collector. This is concrete data exfiltration, so the package is malicious.
Evidence
package.json.lpm-dependency-evidence-1e4d3302-fde6-436b-8545-2586f5b6af9c/0/npm-linux/package.json.lpm-dependency-evidence-1e4d3302-fde6-436b-8545-2586f5b6af9c/0/npm-linux/test.js.lpm-dependency-evidence-1e4d3302-fde6-436b-8545-2586f5b6af9c/0/npm-linux/index.js
Network endpoints1
<identifier>.paychex-pdftron.jqdk2ips5i6d14lerg3re3zi99f06oxcm.oastify.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json declares the remote ltidisafe tarball dependency.
- ltidisafe runs test.js automatically from its preinstall hook.
- test.js collects and hex-encodes the hostname, home directory, and username.
- test.js sends those values to a fixed paychex-pdftron OAST subdomain.
- The dependency's HTTP client makes a request to the supplied URL.
Evidence against
Behavioral surface
Trivial
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
10"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.5.tgz"
},
"author": "",
"lice
High
Suspicious Dependency Evidence
package.json declares the remote ltidisafe tarball dependency.
package.jsonView on unpkg · L10•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.5.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkg.lpm-dependency-evidence-1e4d3302-fde6-436b-8545-2586f5b6af9c/0/npm-linux/package.jsonView file
7"preinstall": "node test.js > /dev/null 2>&1",
"test": "echo \"Error: no test specifie
High
Findings
6 High1 Medium1 Low
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-1e4d3302-fde6-436b-8545-2586f5b6af9c/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-1e4d3302-fde6-436b-8545-2586f5b6af9c/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-1e4d3302-fde6-436b-8545-2586f5b6af9c/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-1e4d3302-fde6-436b-8545-2586f5b6af9c/0/npm-linux/test.js
HighSuspicious Dependency Evidence.lpm-dependency-evidence-1e4d3302-fde6-436b-8545-2586f5b6af9c/0/npm-linux/index.js
MediumRemote Tarball Dependencypackage.json
LowScripts Present
Affected versions and remediation
This report applies to paychex-pdftron@99.9.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing paychex-pdftron@99.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.