Loading npm security reports…

@cap-ts/esi: Malicious npm security report (Block) | LPM Firewall

registry / @cap-ts/esi / 1.8.51

@cap-ts/esi@1.8.51

Enterprise System Integration Based on SAP CAP

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Loading the library runs an obfuscated config loader that fetches and decrypts a remote JSON document, then can abort with a forged npm error. The request host is hidden inside the string decoder.

Static reason

One or more suspicious static signals were detected.

Trigger

Import of the package main, or any module that loads src/lib/_interface/index.js, including src/lib/connect/index.js.

Impact

A remote party can change library availability for every importer, and the thrown text disguises that gate as an npm postinstall failure.

Mechanism

At module load the file loader blocks on HTTPS GET, decrypts AES-256-CBC fields, matches a customer record, reads local consumer config and Cloud Foundry environment, and throws a rotating fake npm message when checks fail.

Attack narrative

The published entry loads connect, which loads the interface module. That module immediately runs an obfuscated loader: it searches the consumer project, blocks on an HTTPS GET to a decoded URL, decrypts the body with AES-256-CBC, and throws a date-picked fake npm error, including a postinstall failure line, when the remote check fails. There is no install script; the behavior starts on import.

AI rationale

Import-time obfuscated HTTPS fetch, AES decryption of the response, and forged npm postinstall errors are a hidden remote kill switch, not ordinary SAP connectivity. The decrypted body is JSON rather than evaluated code, but the loader still gives a remote party control over whether the library throws.

Evidence

src/lib/_interface/file/index.jssrc/lib/_interface/index.jssrc/lib/connect/index.jssrc/index.jssrc/lib/_interface/path/index.js

Source & flagged code

8 flagged · loading source

src/index.jsView file

1const _0x585562=_0x3418;function _0xa2b0(){const _0x437f15=['W4/cQ0SVW7zbpqpdHgO','zCoFm3TEgaKRW5bvgHC6','l8ohdsSuFr/dONGpW64q','[redacted]','AHmFWORcQcbSW6...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/index.jsView on unpkg · L1

1const _0x585562=_0x3418;function _0xa2b0(){const _0x437f15=['W4/cQ0SVW7zbpqpdHgO','zCoFm3TEgaKRW5bvgHC6','l8ohdsSuFr/dONGpW64q','[redacted]','AHmFWORcQcbSW6...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/index.jsView on unpkg · L1

src/lib/_classes/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/lib/_classes/index.js#virtual:normalized:round1View on unpkg

src/lib/_interface/file/index.jsView file

1oHttps['get'](_0x45206d(0x84,'ku(J'),_0x33356e=>{const _0x5298be=_0x45206d;let _0x34b75b='';_0x33356e['on'](_0x43a280[_0x5298be(0xb3,'gkbc')],_0x16280d=>_0x34b75b+=_0x16280d),_0x33

High

Ai Review Evidence

src/lib/_interface/file/index.js performs a blocking HTTPS GET to an obfuscated URL and JSON-parses the body.

src/lib/_interface/file/index.jsView on unpkg · L1

1oDeAsync[_0x45206d(0xd8,'YS9q')](()=>!_0x483bda),_0x533200)throw _0x533200;return _0x4a3a2d;},'getDefaultJSONConfigDataF

High

Ai Review Evidence

src/lib/_interface/file/index.js performs a blocking HTTPS GET to an obfuscated URL and JSON-parses the body.

src/lib/_interface/file/index.jsView on unpkg · L1

1'uTnDs':'aes-256-cbc','HnfED':_0xcfbc12(0xe1,'*PIv'),'RsvIp':_0xcfbc12(0x116,'xjo4'),'aeSHH':_0xcfbc12(0xc9,'QvrD'),'zOurM':function(_0x7b01b2,_0x488a59){return

High

Ai Review Evidence

The fetched object is decrypted with AES-256-CBC before a per-customer lookup.

src/lib/_interface/file/index.jsView on unpkg · L1

1npm\x20ERR!\x20Failed\x20at\x20the\x20postinstall\x20script.',_0x55992f(0x12f,'UwPh'),_0x44a9ae[_0x55992f(0xee,'fV3[')],_0x44a9ae[_0x55992f(

src/lib/_interface/index.jsView file

1oFile=require('./file'),oConfig=oFile[_0x113d91(0x109,'zB)^')](),oLogger=(oLog4js[_0x113d91(0x102,'j0Qv')](_0x113d91(0xe

High

Ai Review Evidence

src/lib/_interface/index.js invokes that loader while the module is loading.

src/lib/_interface/index.jsView on unpkg · L1