registry / Data exfiltration / require-i18next
require-i18next
description
This report shows the evidence for require-i18next@20.0.0. 2 of 2 known versions are blocked or flagged. The newest version, 21.0.0, is blocked. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete install-time data-exfiltration chain with obfuscation and shell execution. It is malicious, not package-aligned behavior.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install (preinstall lifecycle hook)
Impact
Unauthorized host reconnaissance and system-file data exfiltration.
Mechanism
hex-decoded curl command executed through child_process.exec
Attack narrative
During npm preinstall, preinstall.js reads a hex command from preinstall.json, decodes it, and executes it. The decoded command uses curl to send whoami, pwd, hostname, and the contents of /etc/passwd to a remote Pipedream endpoint.
AI rationale
This is a concrete install-time data-exfiltration chain with obfuscation and shell execution. It is malicious, not package-aligned behavior.
Evidence
package.jsonpreinstall.jspreinstall.json/etc/passwd
Network endpoints1
eobdzec83knbura.m.pipedream.net
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- npm preinstall runs preinstall.js.
- The script hex-decodes a command and executes it with child_process.exec.
- The encoded payload invokes curl to eobdzec83knbura.m.pipedream.net and transmits whoami, pwd, hostname, and /etc/passwd contents.
Evidence against
- No legitimate package implementation is present; the archive contains only the manifest and installer payload files.
Behavioral surface
ChildProcessFilesystem
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node preinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg6"scripts": {
"preinstall": "node preinstall.js"
}
High
•scripts.preinstall = node preinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpreinstall.jsView file
•matchType = malicious_source_fingerprint_signature
signature = f243d5785c040017
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = trinity-scheme@20.0.0
matchedPath = preinstall.js
matchedIdentity = npm:dHJpbml0eS1zY2hlbWU:20.0.0
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
Findings
5 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturepreinstall.js
HighAi Review Evidencepackage.json
HighAi Review Evidencepreinstall.js
HighAi Review Evidencepreinstall.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to require-i18next@20.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing require-i18next@20.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.