@adminide-stack/utils@0.0.16-129
Adminide utils for higher packages to depend on
AI Security Review
scanned 22h ago · by lpm-firewall-aiThe package's main entry runs a concealed payload automatically on import. The payload retrieves and executes remote code unrelated to the advertised utility, so this is malicious remote code execution.
Decision evidence
public snapshot- package.json selects lib/index.js as the package entry point.
- lib/index.js runs eval(atob(...)) at top level, decoding and executing a concealed payload on import.
- Static decoding of the payload shows Ethereum transaction lookups, a fetch to an IP derived from transaction data, evaluation of the response, and launch of a detached Node process.
- The package describes itself as a utility package and its visible entry code re-exports a logger module.
Source & flagged code
5 flaggedlib/index.js runs eval(atob(...)) at top level, decoding and executing a concealed payload on import.
lib/index.jsView on unpkg · L138Static decoding of the payload shows Ethereum transaction lookups, a fetch to an IP derived from transaction data, evaluation of the response, and launch of a detached Node process.
lib/index.jsView on unpkg · L138Package source references a known benign dynamic code generation pattern.
lib/index.jsView on unpkg · L137Findings
Affected versions and remediation
This report applies to @adminide-stack/utils@0.0.16-129.
See all versions of @adminide-stack/utils for other recorded verdicts.
- Avoid installing @adminide-stack/utils@0.0.16-129. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.