registry / tracker-radar-detector / 1.0.1

tracker-radar-detector@1.0.1

AI Security Review

scanned 5h ago · by lpm-firewall-ai

The preinstall hook executes index.js automatically on npm installation. It harvests host and local system-file data, then sends it to an unrelated external host.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install or any install action that runs the preinstall lifecycle hook.

Impact

Exposure of username, hostname, home/install paths, DNS configuration, and contents of /etc/passwd and /etc/hosts.

Mechanism

install-time host fingerprinting and data exfiltration via HTTPS POST

Attack narrative

Installation invokes package-controlled index.js through preinstall. The script gathers host identity and network configuration, reads /etc/passwd and /etc/hosts if available, serializes the data, and POSTs it to mka6p95xmnkfcmdxv8cb4h2rpivej47t.oastify.com. This is unconsented install-time data exfiltration.

Rationale

Direct source inspection confirms an automatic preinstall hook performing local-file and host-data exfiltration to an external OAST endpoint. This is concrete malicious behavior, not merely a suspicious primitive.

Evidence

package.jsonindex.js/etc/passwd/etc/hosts

Network endpoints1

mka6p95xmnkfcmdxv8cb4h2rpivej47t.oastify.com

tracker-radar-detector@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code