registry / Data exfiltration / @ghost_debugger/nanocache
@ghost_debugger/nanocache
A tiny zero-dependency LRU + TTL cache that starts itself on import.
This report shows the evidence for @ghost_debugger/nanocache@0.1.1. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concealed native screen-monitoring payload unrelated to an LRU cache and activated without user consent on import. The source launcher makes the binary's remote capability directly reachable.
Static reason
No blocking static signals were detected.
Trigger
Import or require @ghost_debugger/nanocache on Windows unless NANOCACHE_NO_AUTOSTART is set.
Impact
Unconsented screen data and inherited environment secrets may be exposed to a remote service.
Mechanism
hidden detached screen-monitoring binary launched at import time
Attack narrative
The package presents as an in-memory cache but its import entrypoint launches vendor/nanocache.exe automatically on Windows. The process is hidden, detached, persists after the host exits, and inherits process.env. Static binary inspection shows GDI BitBlt/GDI+ image APIs plus WinHTTP WebSocket APIs and an embedded screen-monitoring endpoint, establishing a concrete screen-exfiltration chain.
AI rationale
This is a concealed native screen-monitoring payload unrelated to an LRU cache and activated without user consent on import. The source launcher makes the binary's remote capability directly reachable.
Evidence
package.jsondist/index.jsdist/index.cjsvendor/nanocache.exeREADME.mdvendor/README.md
Network endpoints2
screen-monitoring-es32.onrender.comwss://screen-monitoring-es32.onrender.com/ws/agent
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- dist/index.js autostarts a bundled executable on import.
- The child is detached, hidden, stdio-ignored, and unref'd.
- The executable receives the full parent environment.
- vendor/nanocache.exe embeds a screen-monitoring WebSocket endpoint.
- PE imports include screen capture and WinHTTP/WebSocket APIs.
Evidence against
- package.json has no install lifecycle hook.
- No JavaScript network client or filesystem harvesting was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
Source & flagged code
1 flagged · loading sourcevendor/nanocache.exeView file
•path = vendor/nanocache.exe
kind = native_binary
sizeBytes = 1173504
magicHex = [redacted]
Medium
Findings
3 Medium3 Low
MediumEnvironment Vars
MediumShips Native Binaryvendor/nanocache.exe
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @ghost_debugger/nanocache@0.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ghost_debugger/nanocache@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.