registry / text-line-parser / 1.0.0

text-line-parser@1.0.0

Line-by-line text and stream parsing utilities

AI Security Review

scanned 18d ago · by lpm-firewall-ai

npm installation automatically executes an environment-harvesting shell command. It exfiltrates encoded host and environment data to an external host and probes cloud metadata services.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing text-line-parser@1.0.0, which invokes its postinstall hook.

Impact

Exposure of CI identifiers, environment variables that may contain credentials, host/process/network details, and cloud-metadata reachability.

Mechanism

postinstall shell-based host/environment reconnaissance and HTTP exfiltration

Attack narrative

On npm installation, package.json launches postinstall.js. That script runs shell reconnaissance, including filtered environment variables and CI context, encodes the results, and sends them to an OAST domain. It also probes AWS and Tencent metadata endpoints, consistent with credential-environment targeting.

Rationale

The malicious behavior is directly reachable at install time and has no package-related purpose. It combines host/credential-context collection, metadata probing, and external exfiltration.

Evidence

package.jsonpostinstall.jsindex.js/etc/resolv.conf/proc/1/cgroup/.dockerenv

Network endpoints3

pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/z?d=$datametadata.tencentyun.com/latest/meta-data//latest/meta-data/

The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs (hexToRgb/rgbToHsl). On `npm install`, postinstall.js executes a shell pipeline that collects hostname, user, cwd, `uname`, `/proc/1/cgroup`, `/.dockerenv`, the process tree, local IP addresses, `/etc/resolv.conf` nameservers, and probes Tencent Cloud and AWS IMDS cloud-metadata endpoints. It then dumps the full process environment (filtering only npm_* noise, so CI tokens, cloud credentials, and API keys are captured) together with GitHub Actions identifiers (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, CI, RUNNER_NAME), base64-encodes the payload, and sends it via HTTP to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The declared package purpose does not require any of this behavior; the mismatch between the advertised text-parsing role and the shipped reconnaissance/exfiltration code is consistent with a typosquat/decoy supply-chain attack.

text-line-parser@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code