registry / @mgor/fw-canary-3333 / 0.0.1

@mgor/fw-canary-3333@0.0.1

Ephemeral supply-chain firewall canary. Not for use. Safe to unpublish.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

Importing the declared main entrypoint immediately launches a shell command. The command downloads content from a remote host and pipes it to Bash.

Static reason

No blocking static signals were detected.

Trigger

Any runtime require/import that resolves package.json's main entrypoint (index.js).

Impact

Remote operator-controlled code executes with the permissions of the consuming Node.js process.

Mechanism

Import-time remote shell-payload execution via curl piped to Bash.

Attack narrative

A consumer importing this package loads index.js, which immediately invokes child_process.exec. It fetches data from fewafw.hydege.me and pipes it directly to /bin/bash, allowing the host to supply arbitrary shell commands that execute as the consumer process. No npm lifecycle hook is needed because the payload runs at import time.

Rationale

The package contains concrete, unconditional remote-code execution at import time. Its inert-canary documentation is contradicted by the source.

Evidence

package.jsonindex.jsREADME.md

Network endpoints1

fewafw.hydege.me

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-12322

Source

On require of @mgor/fw-canary-3333, index.js executes a top-level shell command that curls https://fewafw.hydege.me and pipes the response into /bin/bash, running attacker-controlled shell content on the installer's host. The fetch is unpinned, unverified, and directed at a non-registry, non-publisher domain, so the executed bytes are whatever the remote host serves at request time. The package.json and README present the package as an inert canary with 'no functionality, no dependencies, and no install scripts', a cover story that directly contradicts the fetch-and-exec side effect in index.js.

@mgor/fw-canary-3333@0.0.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Findings