registry / Install hook abuse / x3r0day-bunnyhijack-poc

x3r0day-bunnyhijack-poc

BunnyHijack PoC - PATH poisoning demo against Bun trustedDependencies

This report shows the evidence for x3r0day-bunnyhijack-poc@1.0.1, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package deliberately impersonates Node to intercept dependency lifecycle execution and performs unconsented local and browser side effects before forwarding the command. Its lack of its own lifecycle hook does not remove the concrete install-hook abuse.

Static reason

No blocking static signals were detected.

Trigger

Installing the package in an environment where a dependency lifecycle command resolves `node` from the dependency binary PATH.

Impact

Unconsented command interception, local project marker creation, execution-context collection, and browser launch during installation.

Mechanism

PATH shadowing of Node during lifecycle execution.

Attack narrative

The manifest exposes a shell script as the `node` binary. When a lifecycle script resolves that binary from the dependency PATH, the shim runs first, writes user, host, directory, and argument details to a marker file, opens an external repository page, and only then runs the genuine Node executable. This is a deliberate install-time PATH-hijacking mechanism, not ordinary package functionality.

AI rationale

Evidence

package.jsonshim.jsnode_modules/.bin/nodepwned-by-bunnyhijack.txt

Network endpoints1

github.com/X3r0Day/BunnyHijack-PoC

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

It installs a bin named `node`, shadowing the system Node executable in dependency script PATHs.
The shim writes a marker containing the invoking user, host, working directory, and command arguments.
The shim launches a browser to an external repository without user interaction.
It then locates and executes the real Node binary, letting the intercepted command continue after its side effects.

Evidence against

package.json contains no package lifecycle hook.
The source contains no credential exfiltration or HTTP upload code.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.55 KB of source, external domains: github.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-20json

2 "name": "x3r0day-bunnyhijack-poc",

3 "version": "1.0.1",

4 "description": "BunnyHijack PoC - PATH poisoning demo against Bun trustedDependencies",

5 "main": "shim.js",

6 "bin": {

7 "node": "./shim.js"

8 },

High

Suspicious Dependency Evidence

It installs a bin named `node`, shadowing the system Node executable in dependency script PATHs.

package.jsonView on unpkg · L5

9 "dependencies": {

10 "protoc-gen-grpc-web": ">=1.0.0"

11 },

12 "keywords": [

13 "bun",

14 "bunnyhijack",

15 "poc",

16 "security"

17 ],

18 "license": "MIT"

19}

•Runtime bin names shadowed by package manifest: node

High

Node Runtime Bin Shadow

Package declares a bin command that shadows a Node package-manager runtime executable.

package.jsonView on unpkg

shim.jsView file

Lines 1-64javascript

1#!/bin/sh

3# BunnyHijack shim. Gets installed as node_modules/.bin/node and runs

4# instead of the real node whenever a lifecycle script calls "node".

6repo="https://github.com/X3r0Day/BunnyHijack-PoC"

Source & flagged code

6 flagged · loading source

package.jsonView file

•Runtime bin names shadowed by package manifest: node

High

Node Runtime Bin Shadow

Package declares a bin command that shadows a Node package-manager runtime executable.

package.jsonView on unpkg

5"main": "shim.js", "bin": { "node": "./shim.js" },

High

Suspicious Dependency Evidence

It installs a bin named `node`, shadowing the system Node executable in dependency script PATHs.

package.jsonView on unpkg · L5

shim.jsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

shim.jsView on unpkg

Findings

6 High1 Medium2 Low

HighNode Runtime Bin Shadowpackage.json

HighSemantic Analysis Limitedshim.js

HighSuspicious Dependency Evidencepackage.json

HighAi Review Evidenceshim.js

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to x3r0day-bunnyhijack-poc@1.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing x3r0day-bunnyhijack-poc@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-04 05:21:33.058Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.1latestshownMaliciousInstall Hook AbuseBlockPublishedSep 3, 2026, 12:38 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other install hook abuse packages

Behavioral surface

Related packages

Other install hook abuse packages

Source & flagged code