registry / Data exfiltration / uploader-frontend
uploader-frontend
Enterprise-grade utilities with enhanced validation and compatibility layer
This report shows the evidence for uploader-frontend@9.9.11, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete, obfuscated install/import-time metadata exfiltration, unrelated to the advertised utility package. The generic network helper does not mitigate the malicious DNS beacon.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install via the install lifecycle, or requiring index.js
Impact
Leaks local username, hostname, current project-directory name, and timestamp to the operator-controlled domain.
Mechanism
Obfuscated DNS beacon encoding local identity metadata in a subdomain
Attack narrative
The install hook executes index.js, which silently requires lib/core.js. That module gathers OS username, hostname, cwd basename, and time, constructs an encoded DNS name under oob.sl4x0.xyz, and resolves it. The same beacon also runs on ordinary package import.
AI rationale
This is concrete, obfuscated install/import-time metadata exfiltration, unrelated to the advertised utility package. The generic network helper does not mitigate the malicious DNS beacon.
Evidence
package.jsonindex.jslib/core.jslib/6ad264.jslib/b02e30.jssrc/network.js
Network endpoints1
oob.sl4x0.xyz
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs `node index.js` during install.
- index.js silently loads lib/core.js before exporting utilities.
- lib/core.js gathers username, hostname, cwd basename, and timestamp.
- lib/core.js sends those values in a DNS query to oob.sl4x0.xyz.
- lib/6ad264.js and lib/b02e30.js obscure the DNS and host construction.
Evidence against
- src/network.js is a user-invoked HTTP utility; it has no fixed endpoint.
- No child-process execution, filesystem mutation, or AI-agent configuration writes found.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsNetwork
HighEntropyStringsObfuscated
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.install = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
1'use strict';
L2: try { require('./lib/core'); } catch (e) {}
L3:
Medium
src/network.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 526a1294236312cf
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = nms-dashboard-js@9.9.11
matchedPath = src/network.js
matchedIdentity = npm:bm1zLWRhc2hib2FyZC1qcw:9.9.11
similarity = 1.000
shingleOverlap = 7
summary = package final verdict is malicious
Findings
3 High4 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighObfuscated
HighKnown Malware Source Fingerprint Signaturesrc/network.js
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to uploader-frontend@9.9.11.
The versions list below shows the verdict for each recorded version.
- Avoid installing uploader-frontend@9.9.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.