registry / Data exfiltration / typescript-rest-api-generator
typescript-rest-api-generator
CLI to generate TypeScript REST API with custom templates
This report shows the evidence for typescript-rest-api-generator@1.0.21. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource directly establishes collection of device identifiers and their transmission to an unrelated endpoint when the generator is used. Although it is user-command triggered rather than install-time, it is concrete data exfiltration.
Static reason
No blocking static signals were detected.
Trigger
User runs `rag new <projectName>`.
Impact
Exposes device identifiers and hardware metadata to a third party.
Mechanism
Host fingerprinting followed by HTTP POST exfiltration.
Attack narrative
The CLI's `new` command obtains OS, hardware UUID data, MAC addresses, CPU brand, and chassis type through `systeminformation`. It then POSTs those values to `hksp8.aiccloud.online` before creating the requested project. This undisclosed host-fingerprinting collection is not required for the advertised generator function.
AI rationale
Source directly establishes collection of device identifiers and their transmission to an unrelated endpoint when the generator is used. Although it is user-command triggered rather than install-time, it is concrete data exfiltration.
Evidence
commands/create.command.jsast/info.jspackage.json
Network endpoints1
hksp8.aiccloud.online/ragapi/system-details/create
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- `rag new` collects a system UUID, OS identifier, MAC addresses, CPU brand, and chassis type.
- The collected machine identifiers are POSTed to an unrelated remote host before project creation.
Evidence against
- No npm preinstall, install, or postinstall lifecycle hook is declared.
- The observed exfiltration is gated on the explicit `rag new <projectName>` command.
Behavioral surface
ChildProcessFilesystemNetworkShell
UrlStrings
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
2 High1 Medium3 Low
HighAi Review Evidence
HighAi Review Evidence
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to typescript-rest-api-generator@1.0.21.
The versions list below shows the verdict for each recorded version.
- Avoid installing typescript-rest-api-generator@1.0.21. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.