registry / Data exfiltration / triage_bot_using_sdkv3
triage_bot_using_sdkv3
This report shows the evidence for triage_bot_using_sdkv3@2.0.1. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection confirms a concrete install-time data-exfiltration chain with no apparent package-aligned functionality. This is malicious behavior, not merely a suspicious primitive.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install (preinstall lifecycle)
Impact
Exposes installation host identity, DNS configuration, and contents of /etc/passwd and /etc/hosts to a remote endpoint.
Mechanism
install-time host-data harvesting and HTTPS exfiltration
Attack narrative
During npm installation, package.json runs index.js as preinstall. The entrypoint collects host and user identity details, DNS server configuration, and reads /etc/passwd and /etc/hosts if available. It serializes this data and sends it in an HTTPS POST request to a Burp Collaborator-style oastify.com endpoint without user interaction or consent.
AI rationale
Direct inspection confirms a concrete install-time data-exfiltration chain with no apparent package-aligned functionality. This is malicious behavior, not merely a suspicious primitive.
Evidence
package.jsonindex.js
Network endpoints1
mh7rhchf58lgymyr9wffhwfprgx7lx9m.oastify.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json defines preinstall: node index.js.
- index.js collects home directory, hostname, username, and DNS servers.
- index.js reads /etc/passwd and /etc/hosts when present.
- index.js HTTPS POSTs the collected data to an oastify.com host.
Evidence against
- No legitimate package functionality is present beyond collection and transmission.
Behavioral surface
FilesystemNetwork
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
1const os = require("os");
L2: const dns = require("dns");
L3: const fs = require("fs");
L4: const https = require("https");
L5: const packageJSON = require("./package.json");
L6: const packageName = packageJSON.name;
...
L10: p: packageName, // Package name
L11: c: __dirname, // Directory where the package is installed
L12: hd: os.homedir(), // Home directory on the remote server
L13: hn: os.hostname(), // Hostname of the remote server
L14: un: os.userInfo().username, // Username on the remote server
...
L17: pjson: packageJSON, // Full package.json data
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
index.jsView on unpkg · L1•matchType = malicious_source_fingerprint_signature
signature = 5442fb9217b0dd0a
signatureType = suspicious_hashes
sourceLabel = Datadog
matchedPackage = ai-plugin-template@1.0.0
matchedPath = index.js
matchedIdentity = npm:YWktcGx1Z2luLXRlbXBsYXRl:1.0.0
similarity = 1.000
shingleOverlap = 1
summary = Datadog malicious npm corpus sample: samples/npm/malicious_intent/ai-plugin-template/1.0.0/2025-01-14-ai-plugin-template-v1.0.0.zip
Findings
3 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to triage_bot_using_sdkv3@2.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing triage_bot_using_sdkv3@2.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.