registry / strapi-plugin-vinsoc-1109 / 3.6.8

strapi-plugin-vinsoc-1109@3.6.8

Authorized security PoC (VinSOC engagement). Benign OOB callback only. Do not use. Will be unpublished.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Installing the package automatically sends an out-of-band DNS lookup and HTTP request containing the local hostname. This exposes machine-identifying data to an external OAST service without installer consent.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation triggers the postinstall lifecycle hook.

Impact

A package install signals execution and discloses the installing host's hostname to an external party.

Mechanism

Hostname collection followed by DNS and HTTP exfiltration.

Attack narrative

The package registers postinstall.js as an automatic npm lifecycle hook. On installation it reads os.hostname(), converts it into a subdomain under an OAST domain, then performs a DNS lookup and an HTTP GET to that external host. The callback is hidden from installation failure by `|| true` and error handlers. Its accompanying claims of benign authorized testing do not establish user consent for automatic external disclosure.

AI rationale

This is concrete unconsented install-time host data exfiltration to an external endpoint. The lifecycle trigger and callback are directly established by source inspection.

Evidence

package.jsonpostinstall.js

Network endpoints1

1bdtwmd0wdrpwnlput1up9x39ufl3br0.oastify.com

OSV advisory

OpenSSF/OSV

The package's postinstall lifecycle script (`node postinstall.js || true`) fires automatically on `npm install`. postinstall.js reads `os.hostname()`, embeds the sanitized value as a subdomain of the hardcoded host `1bdtwmd0wdrpwnlput1up9x39ufl3br0.oastify.com` (a Burp Collaborator out-of-band collector), and performs both a DNS lookup and a plain-HTTP GET to `/poc/<hostname>` at that host. The result is silent transmission of the installer's machine identifier to an attacker-controlled OOB endpoint on every install, with errors swallowed so the install does not visibly fail. The package name and version resemble a scoped Strapi plugin but the shipped payload performs no plugin functionality — only the beacon. ## Source: ossf-package-analysis (3dad65e846069addf34b62c3321a51ff2d43b04f6385c7edcbd8f3a2552e876b) The OpenSSF Package Analysis project identified 'strapi-plugin-vinsoc-1109' @ 3.6.8 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

strapi-plugin-vinsoc-1109@3.6.8

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code