triage_bot_using_sdkv3@2.0.1: Malicious npm security report

Loading npm security reports…

Source & flagged code

3 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const os = require("os"); L2: const dns = require("dns"); L3: const fs = require("fs"); L4: const https = require("https"); L5: const packageJSON = require("./package.json"); L6: const packageName = packageJSON.name; ... L10: p: packageName, // Package name L11: c: __dirname, // Directory where the package is installed L12: hd: os.homedir(), // Home directory on the remote server L13: hn: os.hostname(), // Hostname of the remote server L14: un: os.userInfo().username, // Username on the remote server ... L17: pjson: packageJSON, // Full package.json data

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•matchType = malicious_source_fingerprint_signature signature = 5442fb9217b0dd0a signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = ai-plugin-template@1.0.0 matchedPath = index.js matchedIdentity = npm:YWktcGx1Z2luLXRlbXBsYXRl:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = Datadog malicious npm corpus sample: samples/npm/malicious_intent/ai-plugin-template/1.0.0/2025-01-14-ai-plugin-template-v1.0.0.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

triage_bot_using_sdkv3@2.0.1: Malicious npm security report | LPM Firewall

triage_bot_using_sdkv3@2.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code