spectral-net-probe@1.0.4
spectral corsair net probe telemetry
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest activates a request during installation, and the source sends it to a fixed, unrelated tunnel endpoint without consent. This is an automatic install-time beacon and supports blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
The package's postinstall lifecycle hook runs.
Impact
The endpoint receives an unsolicited install-time request and the installer's network address.
Mechanism
The hook launches index.js, which makes an HTTPS GET request to a fixed marker URL and ignores errors.
Attack narrative
On installation, the postinstall hook runs index.js, which sends a request to a fixed Cloudflare tunnel URL. This discloses the installer's network address and package execution without an installer consent guard.
AI rationale
The manifest activates a request during installation, and the source sends it to a fixed, unrelated tunnel endpoint without consent. This is an automatic install-time beacon and supports blocking.
Evidence
package.jsonindex.js
Network endpoints1
imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs index.js automatically during postinstall.
- index.js sends an automatic HTTPS request to an unrelated Cloudflare tunnel endpoint, disclosing the installer's network address and package execution.
Evidence against
- The request includes only a fixed marker and version value; the source shows no explicit host, user, or project data collection.
Behavioral surface
Network
HighEntropyStringsTrivialUrlStrings
Source & flagged code
3 flaggedpackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"postinstall": "node index.js"
}
}
High
Suspicious Lifecycle Evidence
package.json runs index.js automatically during postinstall.
package.jsonView on unpkg · L8index.jsView file
1const https=require('https');
https.get('https://imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1',x=>x.resume()).on('error',()=>{});
module.exports=1;
High
Ai Review Evidence
index.js sends an automatic HTTPS request to an unrelated Cloudflare tunnel endpoint, disclosing the installer's network address and package execution.
index.jsView on unpkg · L1Findings
3 High1 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to spectral-net-probe@1.0.4.
See all versions of spectral-net-probe for other recorded verdicts.
- Avoid installing spectral-net-probe@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.