@asyncapi/generator
The AsyncAPI generator. It can generate documentation, code, anything!
This report shows the evidence for @asyncapi/generator@3.3.1. 3 of 5 known versions are blocked or flagged. The newest version, 3.5.0, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains an import-time, obfuscated detached child-process launcher in a validator module. This is concrete hidden execution, not a package-aligned generator feature.
Static reason
One or more suspicious static signals were detected.
Trigger
Import `lib/generator.js` or otherwise load `lib/templates/config/validator.js`.
Impact
Unconsented hidden code execution with potential local collection and network activity.
Mechanism
Import-time obfuscated detached child-process payload.
Attack narrative
`lib/generator.js` imports `validateTemplateConfig` from `lib/templates/config/validator.js`. That validator contains a large obfuscated appendage which immediately invokes `main()`, spawns a detached, hidden `node -e` process with an obfuscated command, and unreferences it. Its wrapper imports filesystem, OS, path, HTTPS, and child-process modules. This import-time concealed execution is unrelated to validation and is a concrete malicious execution chain.
AI rationale
The package contains an import-time, obfuscated detached child-process launcher in a validator module. This is concrete hidden execution, not a package-aligned generator feature.
Evidence
package.jsonlib/generator.jslib/templates/config/validator.jslib/utils.jslib/hooksRegistry.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `lib/templates/config/validator.js:69` contains a 7.6KB obfuscated injected payload.
- Payload executes `main()` at module load, before validator exports are used.
- Payload imports `child_process` and calls detached hidden `spawn(...).unref()`.
- Spawned process is `node -e` with an obfuscated second-stage command.
- Payload also imports `fs`, `os`, `path`, and `https`, inconsistent with template validation.
- `lib/generator.js:14` imports this validator, so importing the package triggers it.
Evidence against
- `package.json` has no preinstall/install/postinstall lifecycle hook.
- The surrounding validator code is ordinary template configuration validation.
- Normal generator file writes and template installation are user-invoked features.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsObfuscated
Source & flagged code
3 flagged · loading sourcejest.config.jsView file
1const baseConfig = require('../../jest.config.base');
L2:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
jest.config.jsView on unpkg · L1lib/templates/config/validator.jsView file
68}
L69: const _0x1dd48b=_0x1dd2;(function(_0x3aef98,_0x501ff1){const _0x1cd183=_0x1dd2,_0x593225=_0x3aef98();while(!![]){try{const _0x268eb2=parseInt(_0x1cd183(0x17c))/0x1*(parseInt(_0x1cd...
L70: /**
High
Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
lib/templates/config/validator.jsView on unpkg · L68lib/templates/bakedInTemplates/core-template-client-websocket-java-quarkus/template/mvnw.cmdView file
Findings
2 High6 Medium4 Low
HighObfuscated Payload Loaderlib/templates/config/validator.js
HighObfuscated
MediumDynamic Requirejest.config.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperlib/templates/bakedInTemplates/core-template-client-websocket-java-quarkus/template/mvnw.cmd
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @asyncapi/generator@3.3.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @asyncapi/generator@3.3.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.