@arv-bedrock/auth@1.1.7: Malicious npm security report (Block)

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Install-time code downloads an external runtime and executes an obfuscated second-stage payload. That payload dynamically evaluates fetched code and contains credential/token-harvesting behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm preinstall

Impact

Arbitrary code execution and potential credential exfiltration during dependency installation.

Mechanism

remote runtime bootstrap followed by obfuscated dynamic payload execution

Attack narrative

On preinstall, setup.mjs obtains Bun from GitHub if unavailable and uses it to run math_init.js. The latter is an obfuscated payload containing network fetch followed by eval of the response, plus token/credential and process-handling code. This concealed install-time execution is unrelated to the published OAuth library.

Rationale

The functional auth bundle is benign, but the concealed preinstall bootstrap executes an obfuscated dynamically evaluated payload. This is concrete install-time malware behavior.

Evidence

package.jsonsetup.mjsmath_init.jsdist/cjs/auth.jstemporary Bun download/extraction directory

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs `node setup.mjs` at preinstall.
setup.mjs downloads Bun 1.3.13 then executes math_init.js during install.
math_init.js is heavily obfuscated and contains fetch-response eval.
math_init.js includes credential/token collection and child-process logic.

Evidence against

dist/cjs/auth.js is a conventional browser OAuth helper.
Runtime auth requests use caller-supplied authHost.

Behavioral surface

Source

ChildProcessEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 740 KB of source, external domains: github.com

Source & flagged code

4 flagged

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

setup.mjsView file

1Manifest entrypoint (scripts.preinstall) carries capability families absent from dist/build output: execution+network L1: #!/usr/bin/env node L2: import { execFileSync } from "child_process"; L3: import _0x488df8 from "fs"; L4: import _0x52943e from "https"; L5: import _0x24db8d from "os"; ... L50: function ra() { L51: const _0x51cd53 = process.platform + "-" + process.arch; L52: const _0x3ab5c4 = PM[_0x51cd53]; ... L218: } else if (_0xc0d7d2 === 8) { L219: _0x27994e = _0x548d91.inflateRawSync(_0x5975df); L220: } else {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

setup.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @ornikar/eslint-config-babel-use@13.2.7 matchedPath = setup.mjs matchedIdentity = npm:[redacted]:13.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.mjsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

setup.mjsView file

1Manifest entrypoint (scripts.preinstall) carries capability families absent from dist/build output: execution+network L1: #!/usr/bin/env node L2: import { execFileSync } from "child_process"; L3: import _0x488df8 from "fs"; L4: import _0x52943e from "https"; L5: import _0x24db8d from "os"; ... L50: function ra() { L51: const _0x51cd53 = process.platform + "-" + process.arch; L52: const _0x3ab5c4 = PM[_0x51cd53]; ... L218: } else if (_0xc0d7d2 === 8) { L219: _0x27994e = _0x548d91.inflateRawSync(_0x5975df); L220: } else {

Findings

3 High2 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencesetup.mjs

HighKnown Malware Source Similaritysetup.mjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalmath_init.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings