totp-utils@1.4.9: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

totp-utils@1.4.9: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./index.js --setup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./index.js --setup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = totp-utils@1.4.8 matchedPath = index.js matchedIdentity = npm:dG90cC11dGlscw:1.4.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = f1fd3702acd9ebec signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = totp-utils@1.4.8 matchedPath = index.js matchedIdentity = npm:dG90cC11dGlscw:1.4.8 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

index.jsView on unpkg · L3

index.js#virtual:normalized:round1View file

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.js#virtual:normalized:round1View on unpkg · L3

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.js#virtual:normalized:round1View on unpkg · L3

3Trigger-reachable chain: scripts.postinstall -> index.js L3: const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Source & flagged code

9 flagged

package.jsonView file

Lines 1-18json

1{

2 "name": "totp-utils",

3 "version": "1.4.9",

4 "description": "Lightweight TOTP/HOTP token generation utilities — no dependencies, pure Node.js crypto",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "node ./index.js --setup"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

9 "keywords": ["totp", "hotp", "2fa", "otp", "authenticator", "token", "crypto"],

10 "license": "MIT",

11 "author": "totp-utils contributors",

12 "repository": {

13 "type": "git",

14 "url": "git+https://github.com/totp-utils/totp-utils.git"

15 },

16 "engines": { "node": ">=14" }

17}

18

index.jsView file

Lines 1-23javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

4const https

index.js#virtual:normalized:round1View file

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.js#virtual:normalized:round1View on unpkg · L3

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.js#virtual:normalized:round1View on unpkg · L3

3Trigger-reachable chain: scripts.postinstall -> index.js L3: const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));