@factiii/runner@0.28.0
OpenSSF/OSV Malicious Advisory
imported 3h ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18204 confirms this npm version as malicious.
Advisory
MAL-2026-18204
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @factiii/runner (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The source shows a conditional token exposure path to an environment-configured endpoint without a destination allowlist, which warrants a warning under the credential-forwarding policy. The package’s lifecycle script is publish-only, and the inspected GitHub OAuth and Git credential flows are service-aligned.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The index service has an EMBED_URL and receives the runner token, then an error-reporting path attempts to send a report.
Impact
A misconfigured or untrusted report endpoint could receive the runner token along with a redacted error report.
Mechanism
The service posts to the configured report URL with the runner token in an authentication header; the source does not restrict the destination to an approved host.
AI rationale
The source shows a conditional token exposure path to an environment-configured endpoint without a destination allowlist, which warrants a warning under the credential-forwarding policy. The package’s lifecycle script is publish-only, and the inspected GitHub OAuth and Git credential flows are service-aligned.
Evidence
dist/cli.jsindex/index.js
Independent scan evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- The package has a prepublishOnly build and packaging script, with no preinstall, install, or postinstall hook.
- The CLI defaults to Factiii’s API, and its GitHub OAuth helper sends GitHub tokens to api.github.com.
- The runner sends its saved auth token to the local index service; when an error report is sent, that service uses the token to authenticate to the EMBED_URL report endpoint. The endpoint has no source-level destination allowlist or affirmative reporting opt-in.
- The Git credential helper answers only HTTPS requests for github.com; the bundled node-datachannel files expose WebRTC bindings and load a native addon.
Evidence against
- The inspected package source does not establish token transfer to a fixed unrelated recipient or an install-time attack.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
16 flagged · loading sourcedist/cli.jsView file
38* Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L964: var EventEmitter = require("node:events").EventEmitter;
L965: var childProcess = require("node:child_process");
L966: var path48 = require("node:path");
...
L1013: this._outputConfiguration = {
L1014: writeOut: (str) => process3.stdout.write(str),
L1015: writeErr: (str) => process3.stderr.write(str),
...
L1049: * @returns {Command[]}
L1050: * @private
L1051: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L3838Trigger-reachable chain: scripts.start -> dist/cli.js
L38: * Constructs the CommanderError class
L39: * @param {number} exitCode suggested exit code which could be used with process.exit
L40: * @param {string} code an id string representing the error
...
L964: var EventEmitter = require("node:events").EventEmitter;
L965: var childProcess = require("node:child_process");
L966: var path48 = require("node:path");
...
L1013: this._outputConfiguration = {
L1014: writeOut: (str) => process3.stdout.write(str),
L1015: writeErr: (str) => process3.stderr.write(str),
...
L1049: * @returns {Command[]}
L1050: * @private
L1051: */
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsView on unpkg · L38Findings
3 Critical9 High7 Medium6 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltaplugin/factiii/bin/factiii-secrets
HighChild Processdist/cli.js
HighShelldist/cli.js
HighEvaldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @factiii/runner@0.28.0.
See all versions of @factiii/runner for other recorded verdicts.
- Avoid installing @factiii/runner@0.28.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.