registry / Data exfiltration / pp-react-v5
pp-react-v5
Internal App bUg b0UntY gollum22 h1
This report shows the evidence for pp-react-v5@30.0.2. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiDirect source inspection confirms unconsented install-time collection and external exfiltration of local environment data. This is concrete malicious behavior rather than package-aligned telemetry.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install or package import via main index.js
Impact
Leaks user, host, home directory, install path, DNS resolver, and package metadata to an external collector.
Mechanism
install-time environment metadata exfiltration over HTTPS and DNS
Attack narrative
On installation, npm runs node index.js twice via preinstall and postinstall. The script builds a JSON object containing local host/user/install metadata, computes a hash, performs an external DNS lookup containing hostname/hash, then posts the full trackingData body to an oast.fun HTTPS endpoint while ignoring errors.
AI rationale
Direct source inspection confirms unconsented install-time collection and external exfiltration of local environment data. This is concrete malicious behavior rather than package-aligned telemetry.
Evidence
package.jsonindex.js
Network endpoints3
bvfmpadujgjgmbtzeibi1n3vi1psox11k.oast.funbvfmpadujgjgmbtzeibi1n3vi1psox11k.oast.fun/<hostname>.<hash>.bvfmpadujgjgmbtzeibi1n3vi1psox11k.oast.fun
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json defines preinstall and postinstall as node index.js, causing install-time execution.
- index.js collects homedir, hostname, username, DNS servers, install directory, package metadata into trackingData.
- index.js sends trackingData via HTTPS POST to bvfmpadujgjgmbtzeibi1n3vi1psox11k.oast.fun.
- index.js also triggers DNS lookup to <hostname>.<hash>.bvfmpadujgjgmbtzeibi1n3vi1psox11k.oast.fun for out-of-band tracking/exfiltration.
- Only two package files exist, and index.js is both main entrypoint and lifecycle payload.
Evidence against
- No child_process, persistence, destructive filesystem writes, native binary loading, or dependency install observed.
- No credential-specific file reads observed beyond OS/user/package metadata collection.
Behavioral surface
CryptoNetwork
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
1const os = require("os");
L2: const dns = require("dns");
L3: const querystring = require("querystring");
...
L5: const crypto = require("crypto"); // Para generar hash
L6: const packageJSON = require("./package.json");
L7: const package = 'pp-react-v5 bug bounty';
...
L11: p: package,
L12: c: __dirname,
L13: hd: os.homedir(),
L14: hn: os.hostname(),
L15: un: os.userInfo().username,
...
L85:
Low
Findings
1 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
LowScripts Present
LowWeak Cryptoindex.js
Affected versions and remediation
This report applies to pp-react-v5@30.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing pp-react-v5@30.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.