spectral-net-probe@1.0.10
local module config sync helper
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe postinstall hook loads code that initiates network activity, accepts file paths from a response, reads those files, and sends their contents to a fixed external address. This is concrete install-triggered data exfiltration behavior.
Decision evidence
public snapshot- The postinstall command requires the package entrypoint, which starts network requests as a module-load side effect.
- The entrypoint contacts a loopback service and a fixed external IP address.
- A response supplies up to ten file paths; the package reads those files and places up to 400 characters of their contents into a request body.
- The package sends that body with HTTP PUT requests to both configured destinations.
Source & flagged code
8 flaggedInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall command requires the package entrypoint, which starts network requests as a module-load side effect.
package.jsonView on unpkg · L8Findings
Affected versions and remediation
This report applies to spectral-net-probe@1.0.10.
See all versions of spectral-net-probe for other recorded verdicts.
- Avoid installing spectral-net-probe@1.0.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.