registry / pulse-pwn-9f3a2 / 1.0.2

pulse-pwn-9f3a2@1.0.2

AI Security Review

scanned 20d ago · by lpm-firewall-ai

The runtime entrypoint transfers the content of a profile endpoint to a fixed external webhook. This is confirmed data exfiltration on import.

Static reason

No blocking static signals were detected.

Trigger

Importing or otherwise executing the package entrypoint.

Impact

Profile data available to the caller's origin can be disclosed to a third party.

Mechanism

Fetches profile data and posts it to an external webhook.

Attack narrative

A consumer importing the package executes index.js. It reads the response from /profile as text and sends that text in a POST request to a fixed webhook.site URL. The manifest exposes this behavior through the main entrypoint, so it does not require an explicit exported function call.

AI rationale

The package contains a direct, import-time profile-data transfer to an unrelated fixed endpoint. There is no legitimate package functionality or consent mechanism present in the inspected source.

Evidence

package.jsonindex.js

Network endpoints2

/profilewebhook.site/42c6d937-77c7-42a5-8678-ef06b4501e38

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with false-positive risk.

pulse-pwn-9f3a2@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code