registry / @divineubg/divine / 1.1.2

@divineubg/divine@1.1.2

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The browser client establishes a remote command channel and executes code supplied through it. It also fetches, decodes, and injects remote game code into an iframe.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading the included browser page starts the client; a remote ntfy message with EVAL_CODE activates arbitrary code execution.

Impact

A sender controlling the ntfy topic can execute arbitrary JavaScript in the page origin and return execution results to the sender.

Mechanism

Remote SSE commands reach eval and Function sinks.

Attack narrative

When the page creates a new local client identity, it calls listen and connects to an ntfy Server-Sent Events topic. A received message containing EVAL_CODE is passed directly to eval or new Function, then its result or error is posted back to ntfy. This is a remote command-and-control channel with arbitrary browser code execution. Separately, game metadata can point to remote assets that are transformed and written into a script-enabled iframe.

Rationale

The code contains an automatic remote command channel whose EVAL_CODE action directly executes attacker-supplied JavaScript. The lack of an npm lifecycle hook does not mitigate this concrete runtime remote-code-execution behavior.

Evidence

index.jspackage.jsonindex.html

Network endpoints2

ntfy.shgcore.jsdelivr.net/gh/divineubg/dva/

@divineubg/divine@1.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code