@adminide-stack/user-activity-browser@1.1.3-alpha.114
Sample core for higher packages to depend on
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe main entry point appends an obfuscated base64 payload that executes at import time and retrieves and runs remote code using a host derived from Ethereum transaction data. This is concealed, automatic remote-code execution unrelated to the package's stated purpose.
Decision evidence
public snapshot- The manifest sets lib/index.js as the package main entry point.
- The entry point contains an eval(atob(...)) payload appended to the bundled library.
- Static decoding shows the payload runs automatically, queries Ethereum RPC and transaction-indexing services, derives a remote host from transaction data, then fetches and executes code and starts a detached Node process.
- The declared package purpose and ordinary library code concern browser activity tracking and GraphQL tracing.
- The manifest has no install lifecycle hooks; its scripts are for building, testing, and prepublishing.
Source & flagged code
5 flaggedThe entry point contains an eval(atob(...)) payload appended to the bundled library.
lib/index.jsView on unpkg · L595Static decoding shows the payload runs automatically, queries Ethereum RPC and transaction-indexing services, derives a remote host from transaction data, then fetches and executes code and starts a detached Node process.
lib/index.jsView on unpkg · L590Package source references a known benign dynamic code generation pattern.
lib/index.jsView on unpkg · L594Findings
Affected versions and remediation
This report applies to @adminide-stack/user-activity-browser@1.1.3-alpha.114.
See all versions of @adminide-stack/user-activity-browser for other recorded verdicts.
- Avoid installing @adminide-stack/user-activity-browser@1.1.3-alpha.114. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.