registry / Data exfiltration / xo-twofa
xo-twofa
Dependency confusion proof of concept package
This report shows the evidence for xo-twofa@28.0.0. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms unconsented install-time host fingerprint exfiltration. This is concrete malicious behavior, not an inert test artifact.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm preinstall during package installation
Impact
Unconsented disclosure of host identity, home-directory path, and DNS configuration.
Mechanism
install-time host fingerprinting and HTTPS exfiltration
Attack narrative
Installing the package invokes its preinstall hook, which executes index.js without user interaction. That script gathers local host and network-identifying data and POSTs it to an external OAST endpoint. The package description identifies it as a dependency-confusion proof of concept, consistent with this install-time callback behavior.
AI rationale
Direct source inspection confirms unconsented install-time host fingerprint exfiltration. This is concrete malicious behavior, not an inert test artifact.
Evidence
package.jsonindex.jsxo-twofa-28.0.0.tgz
Network endpoints1
f4k2mnpoengdb7o3etftn7fmkdq5ew5ku.oastify.com/hit
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs `node index.js` via preinstall.
- index.js collects hostname, OS, architecture, home directory, and DNS servers.
- index.js POSTs collected host data to f4k2mnpoengdb7o3etftn7fmkdq5ew5ku.oastify.com/hit during install.
Evidence against
- No credential-file reads, shell execution, or payload download found in the inspected files.
- Bundled archive contains the same two-file source.
Behavioral surface
Network
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
1const https = require("https");
L2: const os = require("os");
L3: const dns = require("dns");
L4:
L5: const data = JSON.stringify({
L6: hostname: os.hostname(),
L7: platform: os.platform(),
...
L26:
L27: req.write(data);
L28: req.end();
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
index.jsView on unpkg · L1•matchType = malicious_source_fingerprint_signature
signature = 55ef5c661ef1e2d6
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = stargateproxyserv@28.0.0
matchedPath = index.js
matchedIdentity = npm:c3RhcmdhdGVwcm94eXNlcnY:28.0.0
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Findings
3 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumShips Compressed Blobxo-twofa-28.0.0.tgz
LowScripts Present
LowNested Archive Needs Inspectionxo-twofa-28.0.0.tgz
LowNo License
Affected versions and remediation
This report applies to xo-twofa@28.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing xo-twofa@28.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.