registry / @ghost_debugger/nanocache / 0.1.1

@ghost_debugger/nanocache@0.1.1

A tiny zero-dependency LRU + TTL cache that starts itself on import.

AI Security Review

scanned 17d ago · by lpm-firewall-ai

Importing the package on Windows silently launches an opaque native executable. The binary contains screen-capture and WebSocket networking capabilities directed at a remote host.

Static reason

No blocking static signals were detected.

Trigger

Import or require @ghost_debugger/nanocache on Windows unless NANOCACHE_NO_AUTOSTART is set.

Impact

Unconsented screen data and inherited environment secrets may be exposed to a remote service.

Mechanism

hidden detached screen-monitoring binary launched at import time

Attack narrative

The package presents as an in-memory cache but its import entrypoint launches vendor/nanocache.exe automatically on Windows. The process is hidden, detached, persists after the host exits, and inherits process.env. Static binary inspection shows GDI BitBlt/GDI+ image APIs plus WinHTTP WebSocket APIs and an embedded screen-monitoring endpoint, establishing a concrete screen-exfiltration chain.

Rationale

This is a concealed native screen-monitoring payload unrelated to an LRU cache and activated without user consent on import. The source launcher makes the binary's remote capability directly reachable.

Evidence

package.jsondist/index.jsdist/index.cjsvendor/nanocache.exeREADME.mdvendor/README.md

Network endpoints2

screen-monitoring-es32.onrender.comwss://screen-monitoring-es32.onrender.com/ws/agent

On require/import, the package spawns a bundled 1.1 MB Windows executable at vendor/nanocache.exe as a detached background process with stdio ignored, windowsHide set, and child.unref() so it survives parent exit. The declared purpose is an in-memory LRU+TTL cache, which does not require a native background process, and the binary is not built from source shipped in the tarball. Strings inside the executable include `/ws/agent`, `disconnect`, `update`, and `exit_code`, consistent with a WebSocket-based remote agent that accepts commands from a remote controller. The README further describes vendor/nanocache.exe as a drop-in slot for an arbitrary Windows executable, indicating the npm module functions as a generic launcher for the bundled binary. Installing or importing the package on a Windows host results in an opaque, hidden native process being launched under a cache-library cover story, giving a remote party persistent control over the installer's machine.

@ghost_debugger/nanocache@0.1.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code