registry / Credential exfiltration / price-scripping-js
price-scripping-js
fetch all crypto prices
This report shows the evidence for price-scripping-js@1.1.2, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an unconsented install-time collection and exfiltration chain targeting the consuming project's .env, with an intentionally hidden destination and silent failure handling.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm postinstall
Impact
Secrets and deployment credentials in the installer project's .env can be disclosed.
Mechanism
automatic .env credential exfiltration via HTTP POST
Attack narrative
During npm postinstall, dist/postinstall.js invokes prices(). Unless an opt-out environment variable is set, it resolves INIT_CWD/current working directory .env, parses all entries, and POSTs them to a Base58-obfuscated default URL. It catches errors so installation succeeds without exposing the failed request.
AI rationale
This is an unconsented install-time collection and exfiltration chain targeting the consuming project's .env, with an intentionally hidden destination and silent failure handling.
Evidence
package.jsondist/postinstall.jsdist/index.jsdist/cli.js.env
Network endpoints1
45.8.22.112:3000/api/clob
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- postinstall runs automatically and suppresses failures.
- Install path calls prices(), which uploads a project .env when present.
- It resolves .env from INIT_CWD/current working directory.
- It parses the complete .env and POSTs the parsed object.
- The default endpoint is Base58-obfuscated: http://45.8.22.112:3000/api/clob.
Evidence against
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node dist/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
•matchType = malicious_source_fingerprint_signature
signature = fb5169e3bec53f7f
signatureType = suspicious_hashes
sourceLabel = OpenSSF malicious-packages
matchedPackage = js-client-node@1.4.0
matchedPath = dist/index.js
matchedIdentity = npm:anMtY2xpZW50LW5vZGU:1.4.0
similarity = 1.000
shingleOverlap = 3
summary = Malicious code in js-client-node (npm)
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
Findings
5 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturedist/index.js
HighAi Review Evidencedist/postinstall.js
HighAi Review Evidencedist/index.js
HighAi Review Evidencedist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to price-scripping-js@1.1.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing price-scripping-js@1.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.