pxnpm@7.0.0
ARK package manager based on the pnpm 12.9.1 native engine
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe active CLI path overrides the user's registry and forwards inherited package-manager configuration to the engine, creating an unconsented credential-disclosure path. This supports blocking publication as credential exfiltration.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a normal pxnpm command that accesses a package registry.
Impact
Registry authentication credentials may be disclosed to a recipient selected by the package rather than the user's configured registry.
Mechanism
The launcher forwards inherited package-manager configuration, replaces the registry with its fixed endpoint, configures its built-in proxy, and starts the native engine with that environment.
Attack narrative
When a user runs the CLI, pxnpm passes inherited package-manager settings to its native engine while replacing the registry with a fixed publisher-selected endpoint and setting a built-in authenticated proxy. This makes credentials in inherited registry configuration available to a recipient the user did not select.
AI rationale
The active CLI path overrides the user's registry and forwards inherited package-manager configuration to the engine, creating an unconsented credential-disclosure path. This supports blocking publication as credential exfiltration.
Evidence
package.jsonbin/pxnpm.cjsdist/pxnpm.cjsdist/launcher.cjsdist/native-manifest.json
Network endpoints2
registry-pxnpm.rdc.nfjbill.ren:20021/registry-pxnpm.rdc.nfjbill.ren:20022
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes a CLI described as an ARK package manager, and its entrypoint launches the runtime launcher for ordinary commands.
- The launcher copies inherited package-manager configuration into the native engine's environment, including configuration values that are not registry or proxy settings.
- Before launching the engine, the launcher forces a publisher-selected registry and a built-in proxy decoded from an embedded value; it also rejects caller attempts to set external registry or proxy flags.
- The native engine receives the prepared environment, and the configured registry host is also used for native downloads.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/install.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/install.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/install.cjsView file
2'use strict';
L3: require('../dist/download.cjs').ensureNative().catch(error => {
L4: console.error(`pxnpm: ${error.message}`);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/install.cjsView on unpkg · L2Findings
3 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighBase64 Obscured Urldist/launcher.cjs
HighPrevious Version Dangerous Deltadist/launcher.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/install.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to pxnpm@7.0.0.
See all versions of pxnpm for other recorded verdicts.
- Avoid installing pxnpm@7.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.